[MLton] Closure-convert bug

[Stephen Weeks]

> Actually, the bug is in closure converion's flow analysis pass.  

Indeed.

> The fact that the bug is tickled in closure conversion isn't too
> surprising, since you are trying to make a weak pointer to a
> closure.

There were a couple of bugs in abstract-value.fun dealing with weak
pointers.  I've committed a fix.  Wesley's program now prints
"Cleared", which makes sense since MLton proves that the closure needs
no representation, and hence there is nothing in the heap.