InPlaceInterpreter64.asm: use sp as first comparand in the loop VMTraps poll

ARM64 cannot encode sp as Rm in SUBS (only as Rn), so
'bpbeq mem, sp, label' lowers to 'subs xzr, <scratch>, sp' which the
assembler rejects. Swap to the logically equivalent 'bpaeq sp, mem, label'
('subs xzr, sp, <scratch>; b.hs'), matching the existing 'bpa sp, mem'
pattern used elsewhere for stack-limit checks.

Author: robobun

Source/JavaScriptCore/llint/InPlaceInterpreter64.asm

@@ -274,8 +274,9 @@ ipintOp(_loop, macro()
     ipintLoopOSR(1)
     # VMTraps poll: requestStop() sets m_trapAwareSoftStackLimit = UINTPTR_MAX, so a pure
     # Wasm loop (no calls) observes termination/watchdog requests at each back-edge instead of
-    # only at the next function prologue.
-    bpbeq JSWebAssemblyInstance::m_stackMirror + StackManager::Mirror::m_trapAwareSoftStackLimit[wasmInstance], sp, .ipint_loop_no_trap
+    # only at the next function prologue. sp as the first comparand (not second) because ARM64
+    # cannot encode sp as Rm in SUBS.
+    bpaeq sp, JSWebAssemblyInstance::m_stackMirror + StackManager::Mirror::m_trapAwareSoftStackLimit[wasmInstance], .ipint_loop_no_trap
     jmp _ipint_loop_check_vm_traps
 .ipint_loop_no_trap:
     loadb IPInt::InstructionLengthMetadata::length[MC], t0