fastpath xchg ecx for cl not restored on add_check_datastore() match?

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on March 04, 2014 10:10:15_

Like issue #1460 , this bug came from studying instrumentation while analyzing issue #1458 :

+260 L3 8b 00 mov (%eax) -> %eax
+262 m4 @0x284e43f4 64 89 1d c4 0e 00 00 mov %ebx -> %fs:0x00000ec4
+269 m4 @0x284e2dc4
+269 m4 @0x24f6c5ec 8d 50 26 lea 0x26(%eax) -> %edx
+272 m4 @0x24f42614 0f b7 ca movzx %dx -> %ecx
+275 m4 @0x284df2b4 8b da mov %edx -> %ebx
+277 m4 @0x284db3a0 c1 eb 10 shr $0x00000010 %ebx -> %ebx
+280 m4 @0x284e4d6c c1 ea 02 shr $0x00000002 %edx -> %edx
+283 m4 @0x24f41710 03 14 9d 40 d5 c2 73 add 0x73c2d540(,%ebx,4) %edx -> %edx
+290 m4 @0x24f71c78 88 cf mov %cl -> %bh
+292 m4 @0x24f762b8 81 e3 00 03 00 00 and $0x00000300 %ebx -> %ebx
+298 m4 @0x1b18d794 0f b6 0a movzx (%edx) -> %ecx
+301 m4 @0x24f494ac 80 bc 19 c0 a2 a4 73 cmp 0x73a4a2c0(%ecx,%ebx,1) $0x01
01
+309 m4 @0x24f61130 0f 85 fa ff ff ff jnz @0x24f527a0
+315 m4 @0x24f58f88 87 d9 xchg %ecx %ebx -> %ecx %ebx
+317 m4 @0x24f4603c 80 3a 00 cmp (%edx) $0x00
+320 m4 @0x284ed040 74 fe jz @0x1b1966b0
+322 m4 @0x24f5a820 8a cd mov %ch -> %cl
+324 m4 @0x24f7dc94 c0 e1 01 shl $0x01 %cl -> %cl
+327 m4 @0x284ea224 b5 fc mov $0xfc -> %ch
+329 m4 @0x1b193864 d2 c5 rol %cl %ch -> %ch
+331 m4 @0x284da05c 20 2a and %ch (%edx) -> (%edx)
+333 m4 @0x24f437e0 87 d9 xchg %ecx %ebx -> %ecx %ebx
+335 m4 @0x1b1966b0
+335 m4 @0x24f52e54 64 8b 1d c4 0e 00 00 mov %fs:0x00000ec4 -> %ebx
+342 m4 @0x24f4aa68 eb fe jmp @0x24f413d4
+344 m4 @0x284d9190
+344 m4 @0x24f527a0
+344 m4 @0x1b19b5a0 ba f6 d5 cd 69 mov $0x69cdd5f6 -> %edx
+349 m4 @0x24f8ef04 b9 fc df 29 1a mov @0x24f4c4a8 -> %ecx
+354 m4 @0x24f49d3c e9 d8 56 d7 00 jmp $0x1b0136d9
+359 m4 @0x24f4c4a8
+359 m4 @0x24f413d4
+359 L3 c6 40 26 00 mov $0x00 -> 0x26(%eax)
+363 m4 @0x1b02e138
+363 m4 @0x24f6aec8 8d 55 10 lea 0x10(%ebp) -> %edx

***\* TODO bug `#2` : +320 has ebx<->ecx but restores to ebx b/c it skips the 2nd xchg?

That cmp+jz is add_check_datastore(), which targets nowrite_target, which
is fastpath_restore.

To fix: can we assume we can put the xchg in fastpath_restore w/o a jmp?
No, b/c there can be a 2nd dest. So we add a label for the xchg restore,
jmp to there from add_check_datastore(), and from there we jmp to
fastpath_restore. Then then when we add fastpath_restore, check if prior
instr is a jmp that targets it and if so remove the jmp?

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=1461_