Note [PUSH_L underflow]

BCOs can be nested, resulting in nested BCO stack frames where the inner most
stack frame can refer to variables stored on earlier stack frames via the
PUSH_L instruction.

|---------|
|  BCO_1  | -<-┐
|---------|    |
 .........     |
|---------|    | PUSH_L <n>
|  BCO_N  | ->-┘
|---------|

Here BCO_N is syntactically nested within the code for BCO_1 and will result
in code that references the prior stack frame of BCO_1 for some of its local
variables. If a stack overflow happens between the creation of the stack frame
for BCO_1 and BCO_N the RTS might move BCO_N to a new stack chunk while leaving
BCO_1 in place, invalidating a simple offset based reference to the outer stack
frames.
Therefore `SafeSpW` first performs a bounds check to ensure that accesses onto
the stack will succeed. If the target address would not be a valid location for
the current stack chunk then `slow_sp` function is called, which dereferences
the underflow frame to adjust the offset before performing the lookup.

               ┌->--x   |  CHK_1  |
|  CHK_2  |    |    |   |---------|
|---------|    |    └-> |  BCO_1  |
| UD_FLOW | -- x        |---------|
|---------|    |
| ......  |    |
|---------|    | PUSH_L <n>
|  BCO_ N | ->-┘
|---------|

To keep things simpler all accesses to the stack which might go beyond the stack
chunk go through one of the ReadSP* or SafeSP* macros.
When writing to the stack there is no need for checks, we ensured we have space
in the current chunk ahead of time. So there we use SpW and it's variants which
omit the stack bounds check.

See ticket #25750