gh-144681: Fix JIT trace builder assertion failure when conditional branch jump target coincides with fallthrough target

[cocolato]

When the JIT trace builder translates POP_JUMP_IF_TRUE instructions, it determines the branch direction by comparing next_instr (where execution actually went) against computed_jump_instr (the jump target address). However, when oparg equals 1 and the instruction is followed by NOT_TAKEN, the computed jump target and the computed fallthrough target are the same address:

computed_next_instr = target + 2 + 1 (skip NOT_TAKEN) = target + 3
computed_jump_instr = target + 2 + 1 (oparg)

In this minimal reproduction case:

def trigger():
    _ = [x for x in range(200) if [].append(x) or True]

for i in range(300):
    trigger()

print("we finished")

which produces:

...
        POP_JUMP_IF_TRUE         1 (to L4)
L3:     NOT_TAKEN
L4:     LOAD_FAST_BORROW         0 (x)
        LIST_APPEND              3
        JUMP_BACKWARD           30 (to L2)
...

the address comparison computed_jump_instr == next_instr is always true regardless of which branch was actually taken, causing the assertion jump_happened == (target_instr[1].cache & 1) failed when the branch was not taken.

So we should fall back to the RECORD_BRANCH_TAKEN cache bit (target_instr[1].cache & 1) to determine the branch direction, since address comparison is ambiguous.

• Issue: JIT: Different behaviors when JIT is enabled. #144681