fix bugs in cancellable syscall asm

x86_64 was just plain wrong in the cancel-flag-already-set path, and
crashing.

the more subtle error was not clearing the saved stack pointer before
returning to c code. this could result in the signal handler
misidentifying c code as the pre-syscall part of the asm, and acting
on cancellation at the wrong time, and thus resource leak race
conditions.

also, now __cancel (in the c code) is responsible for clearing the
saved sp in the already-cancelled branch. this means we have to use
call rather than jmp to ensure the stack pointer in the c will never
match what the asm saved.

src/thread/i386/syscall_cp.s

@@ -28,9 +28,8 @@ __syscall_cp_asm:
 	popl %edi
 	popl %esi
 	popl %ebx
+	xorl %edx,%edx
+	movl 4(%esp),%ecx
+	movl %edx,(%ecx)
 	ret
-2:	xorl %eax,%eax
-	movl %eax,4(%ecx)
-	movl %eax,(%ecx)
-	pushl $-1
-	call __cancel
+2:	call __cancel