When a function is tree-inlined, copy the condition -> expression mapping
from the inlined function into the caller, shifted so uids are not
mixed. Tree inlining was always problematic under condition coverage -
either through a nullptr dereference (triggered by the test case), or
through quietly mixing caller conditions with the callee conditions.