DR mangling app instructions causes client instrumentation segfault

_From [zhao...@google.com](https://code.google.com/u/106321947286816917100/) on August 25, 2013 00:00:40_

For client with code like below
dst = instr_get_dst(instr, 0);
src = instr_get_src(instr, 0);
instrlist_meta_preinsert
(bb, instr,
INSTR_CREATE_cmp(drcontext, dst, src));
instrlist_meta_preinsert
(bb, instr,
INSTR_CREATE_jcc(drcontext, OP_jne_short,
opnd_create_instr(instr)));

if the source is a TLS instr, DR will mangle the TLS by default (-mangle_app_seg is true), which causes wrong instrumentation:

the original instrs:
0x7f68ded9a73d <_dl_fixup+189>: movl $0x1,%fs:0x4c
instrumented code:
0x4b369a34: cmpl $0x1,%fs:0x4c
0x4b369a40: jne 0x4b369a5e
0x4b369a42: incl 0x26e9869c(%rip) # 0x722020e4
0x4b369a48: movabs %rax,%gs:0x0
0x4b369a53: movabs %gs:0x80,%rax
0x4b369a5e: movl $0x1,0x4c(,%rax,1)

There are two problems:
1. client instrumented code still touch the %fs:0x4c, not mangled 0x4c(,%rax,1)
2. the jmp target is "0x4b369a5e: movl $0x1,0x4c(,%rax,1)", skip the setup instructions:
0x4b369a48: movabs %rax,%gs:0x0
0x4b369a53: movabs %gs:0x80,%rax

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1254_