Fix aarch64 SIGSEGV in linkLightWeightFunctionFrame for large frames

Summary:
On aarch64 with Python 3.12, `add_signed_immediate()` can clobber `arch::reg_scratch_0` when the frame offset exceeds 4095 bytes (the maximum for ARM64 ADD/SUB immediates). On Python 3.12, `frame_holder` aliases x12 (it holds `tstate->cframe`), so the subsequent store to `frame_holder->current_frame` writes to a garbage
address, causing a SIGSEGV. This only triggers for functions with large JIT stack frames (>4103 bytes).

Reviewed By: DinoV

Differential Revision: D96482818

fbshipit-source-id: ba4f08643e281ed80776fe8b22b8900aca381eb6

Author: kddnewton

cinderx/Jit/codegen/frame_asm.cpp

@@ -828,6 +828,12 @@ void FrameAsm::linkLightWeightFunctionFrame(
       scratch,
       arch::ptr_offset(frame_holder, offsetof(PyThreadState, current_frame)));
 #else
+  // add_signed_immediate may have clobbered arch::reg_scratch_0 (x12) when the
+  // offset was too large for an ADD/SUB immediate. frame_holder aliases x12 on
+  // 3.12, so reload it from tstate.
+  as_->ldr(
+      frame_holder,
+      arch::ptr_offset(tstate_reg, offsetof(PyThreadState, cframe)));
   // (PyThreadState.cframe|PyThreadState).current_frame = &cur_frame
   as_->str(
       scratch,