Lack of delay slot checks on capability jump instructions can cause aborts

[bacam]

The qemu implementation of standard jumps and branches raises an exception if one appears in a delay slot, but it doesn't for the capability jumps and branches. This doesn't seem so bad because their behaviour is "UNPREDICTABLE" anyway, except that incompatible branch flags can end up being combined and qemu aborts, even if the offending instruction isn't executed.

This came up in one of my randomly generated tests. A branch-likely instruction is not going to take the branch, and so should skip the instruction in the delay slot. However, qemu will still generate code for the instruction in the delay slot, and it's a capability jump. This 'or's MIPS_HFLAG_BRC on top of the MIPS_HFLAG_BL from the first instruction, giving invalid branch flags which cause an abort in gen_branch.

Here is the end of the trace from running with -d in_asm. The bltzall is the branch-likely instruction and the cjalr is in the delay slot.

0000000040001108: 0432ffe9 bltzall at, 00000000400010b0
0000000040001108: 0432ffe9 enter ds: link 31 cond 800189a target 00000000400010b0
000000004000110c: 48f98d3c blikely condition (0000000040001110)
hflags 0801389a saved 0800009a
000000004000110c: 48f98d3c cjalr t9 17
hflags 0800009a saved 0801389a
unknown branch 0x13800

[staceyson]

The change 1d0b1d2 checks to see if the cjalr or cjr instruction is being used in a delay slot and generates an exception if that is the case.