You encode the test condition in address `ea` and execute some quasi no-op like `test eax, [ea]`. The address space is setup such that `ea` is unmapped / unreadable if the test condition says the code should trap.