freedreno/decode: Fix prefetch handling for IB1 crash

Found this while investigating iova faults, with impossibly low iova
(ie. fault addresses like 0x0000000000181800).  Looks like fetching
past the end of memory mapped GMEM when doing a CP_BLIT resolve blit.
But because the fault GPU is waiting in a CP_WAIT_FOR_ME in IB1 after
the resolve blit, crashdec wasn't correctly finding the location.

We should just skip all the complicated bits working backwards in IB1
to find the jump into IB2 if we see that the crash is actually in IB1.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27508>

src/freedreno/decode/crashdec-prefetch.c

@@ -195,9 +195,14 @@ handle_prefetch(uint32_t *dwords, uint32_t sizedwords)
 {
    struct prefetch_state rb_state = {};
    struct ib *ib1 = scan_cmdstream(&rb_state, 1, dwords, sizedwords);
+
    if (!ib1)
       return;
 
+   /* If the gpu crashed in IB1, we can skip the rest: */
+   if (!options.ibs[2].rem)
+      return;
+
    struct prefetch_state ib1_state = {};
 
    /* Once we find the actual IB1 position, we need to find the IB2 position.