AArch64: avoid branches with explicit offsets at lowering stage.

In discussions with @bnjbvr, it came up that generating `OneWayCondBr`s
with explicit, hardcoded PC-offsets as part of lowered instruction
sequences is actually unsafe, because the register allocator *might*
insert a spill or reload into the middle of our sequence. We were
careful about this in some cases but somehow missed that it was a
general restriction. Conceptually, all inter-instruction references
should be via labels at the VCode level; explicit offsets are only ever
known at emission time, and resolved by the `MachBuffer`.

To allow for conditional trap checks without modifying the CFG (as seen
by regalloc) during lowering, this PR instead adds a `TrapIf`
pseudo-instruction that conditionally skips a single embedded trap
instruction. It lowers to the same `condbr label ; trap ; label: ...`
sequence, but without the hardcoded branch-target offset in the lowering
code.

cranelift/codegen/src/isa/aarch64/abi.rs

@@ -631,14 +631,11 @@ impl AArch64ABIBody {
                 rn: stack_reg(),
                 rm: stack_limit,
             });
-            insts.push(Inst::OneWayCondBr {
-                target: BranchTarget::ResolvedOffset(8),
-                // Here `Hs` == "higher or same" when interpreting the two
-                // operands as unsigned integers.
-                kind: CondBrKind::Cond(Cond::Hs),
-            });
-            insts.push(Inst::Udf {
+            insts.push(Inst::TrapIf {
                 trap_info: (ir::SourceLoc::default(), ir::TrapCode::StackOverflow),
+                // Here `Lo` == "less than" when interpreting the two
+                // operands as unsigned integers.
+                kind: CondBrKind::Cond(Cond::Lo),
             });
         }
     }