cranelift ICE related to lowering saturating_sub

#![feature(custom_mir, core_intrinsics)]
extern crate core;
use core::intrinsics::mir::*;
#[custom_mir(dialect = "runtime", phase = "initial")]
fn fn8(mut _1: &'static u128, mut _2: u128, mut _3: u128, mut _6: u128) -> i32 {
    mir!{
        let _9: *mut i32;
        {
            _6 = false as u128;
            _1 = &_2;
            Call(_2 = core::intrinsics::saturating_sub(_6, _3), ReturnTo(bb2), UnwindUnreachable())
        }
        bb2 = {
            (*_9) = RET >> (*_1);
            Return()
        }
    }
}
pub fn main() {
    fn8(&0, 0, 0, 0);
}

Compile with:
rustc +nightly -Zcodegen-backend=cranelift -Zmir-opt-level=2 -Copt-level=1

thread 'opt cgu.0' (1834994) panicked at /rust/deps/cranelift-codegen-0.132.0/src/isa/aarch64/lower/isle.rs:77:5:                             
called `Option::unwrap()` on a `None` value                                                                                                                                                                          
stack backtrace:
   0: __rustc::rust_begin_unwind                                                                          
             at /rustc/df6ee909ef35c75aa58aa45af6ac071a9b8285c2/library/std/src/panicking.rs:679:5
   1: core::panicking::panic_fmt                                                                                                                                                                                     
             at /rustc/df6ee909ef35c75aa58aa45af6ac071a9b8285c2/library/core/src/panicking.rs:80:14                                                                                                                  
   2: core::panicking::panic          
             at /rustc/df6ee909ef35c75aa58aa45af6ac071a9b8285c2/library/core/src/panicking.rs:150:5                                                                                                                  
   3: core::option::unwrap_failed             
             at /rustc/df6ee909ef35c75aa58aa45af6ac071a9b8285c2/library/core/src/option.rs:2251:5                                                                                                                    
   4: <cranelift_codegen::machinst::isle::IsleContext<cranelift_codegen::isa::aarch64::lower::isle::generated_code::MInst, cranelift_codegen::isa::aarch64::AArch64Backend> as cranelift_codegen::isa::aarch64::lower
::isle::generated_code::Context>::put_in_reg
   5: cranelift_codegen::isa::aarch64::lower::isle::generated_code::constructor_lower::<cranelift_codegen::machinst::isle::IsleContext<cranelift_codegen::isa::aarch64::lower::isle::generated_code::MInst, cranelift
_codegen::isa::aarch64::AArch64Backend>>
   6: <cranelift_codegen::machinst::lower::Lower<cranelift_codegen::isa::aarch64::lower::isle::generated_code::MInst>>::lower::<cranelift_codegen::isa::aarch64::AArch64Backend>
   7: cranelift_codegen::machinst::compile::compile::<cranelift_codegen::isa::aarch64::AArch64Backend>
   8: <cranelift_codegen::isa::aarch64::AArch64Backend as cranelift_codegen::isa::TargetIsa>::compile_function
   9: <cranelift_codegen::context::Context>::compile_stencil
  10: <cranelift_codegen::context::Context>::compile                                                      
  11: <cranelift_object::backend::ObjectModule as cranelift_module::module::Module>::define_function_with_control_plane
  12: rustc_codegen_cranelift::driver::aot::compile_cgu
  13: <rustc_codegen_cranelift::driver::aot::AotDriver as rustc_codegen_ssa::traits::write::WriteBackendMethods>::codegen
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Note that this says aarch64 in the backtrace, but I found the ICE on x86_64 and reduced it on aarch64 so it's either portable or there are two ICEs.

Reproduce the ICE with the provided rustc command and reduced Rust program. Start at cranelift-codegen-0.132.0/src/isa/aarch64/lower/isle.rs:77, then trace the saturating_sub lowering path and the put_in_reg call shown in the backtrace. Done means the reproducer compiles without an Option::unwrap panic on the affected targets.