Fix some bugs with fb_setprofile in ARM mode

Fix some bugs with fb_setprofile in ARM mode

- Have separate stubs for the three return helpers. They don't need to
  be implemented yet, but they all need to have distinct addresses
  because we compare against retInlHelper directly to determine whether
  to run function-exit hooks.

- This exposed a bug in cgGuardRefs, where the "is logical immediate"
  assert was firing. This time I actually invested real time into
  understanding what the hell's going on there and rewrote the thing
  properly. (There are still some improvements to be had: most notably,
  when the mask is a single bit, we can use Tst instead of And-Cmp.)

- Fixups done on faked-up ARs in the simulator's catch block were
  succeeding, but not ones done from VMRegAnchors. The underlying cause
  is that the VM stack is not participating in the native frame pointer
  chain, because we're not using native call instructions to get into or
  out of the TC. I added logic to FixupMap that looks at the stack of
  simulators stored in ExecutionContext, and reads their registers to
  look for the place to apply the fixup.

Reviewed By: @edwinsmith

Differential Revision: D1032483