CRASH (arm chrome) in remove_fraglist_entry

I started chrome on ARM under release build, loaded dynamorio.org once it
had started up, clicked on the docs, browsed a bit in the docs (front page,
BT page, then searched and clicked on dr_get_mcontext), and then on hitting
the Back button I got a crash:

```
: ldr r2, [r5, #4]
Function "0xb006767c" not defined.
(gdb) info line *0xb006767c
Line 8635 of "/home/derek/dr/git/src/core/vmareas.c" starts at address 0xb006767c
and ends at 0xb0067696 .
(gdb) p /x *sc
$2 = {trap_no = 0xe, error_code = 0x5, oldmask = 0x0, arm_r0 = 0x52d4b681, arm_r1 = 0x8000, arm_r2 = 0x0, arm_r3 = 0x0, arm_r4 = 0xb00c4940,
arm_r5 = 0x0, arm_r6 = 0x52d91424, arm_r7 = 0x52d4b680, arm_r8 = 0x0, arm_r9 = 0x0, arm_r10 = 0x1, arm_fp = 0x0, arm_ip = 0x2, arm_sp = 0x52d8ee70,
arm_lr = 0xb006b18b, arm_pc = 0xb006767c, arm_cpsr = 0x480f0030, fault_address = 0x4}
(gdb) frame 0

(gdb) bt
#0 remove_fraglist_entry (dcontext=0x52d4b680, entry=0xb00c4940 , area=0x0) at /home/derek/dr/git/src/core/vmareas.c:8635
#1 0xb006b18a in vm_area_remove_fragment (dcontext=0x52d4b680, f=0xb00c4940 ) at /home/derek/dr/git/src/core/vmareas.c:8799
#2 0xb004af48 in fragment_delete (dcontext=0x52d4b680, f=0xb00c4940 , actions=0)
at /home/derek/dr/git/src/core/fragment.c:3111
#3 0xb005879a in dispatch_enter_dynamorio (dcontext=0x52d4b680) at /home/derek/dr/git/src/core/dispatch.c:825
#4 dispatch (dcontext=0x52d4b680) at /home/derek/dr/git/src/core/dispatch.c:154
```

If that callstack is correct there's a fragment_self_write() frame at
2.5. ?!?

dcontext looks correct:

```
(gdb) p *dcontext
initialized = true,
owning_thread = 8153,
owning_process = 8153,
thread_record = 0x52d47454,
whereami = WHERE_DISPATCH,
allocated_start = 0x52d4b674,
last_fragment = 0x52d91d90,
sys_num = 263,
(gdb) p *dcontext->thread_record
$9 = {
id = 8153,
pid = 8153,
execve = false,
num = 1,
under_dynamo_control = true,
dcontext = 0x52d4b680,
next = 0x0
}
(gdb) p dcontext->last_exit
$6 = (linkstub_t *) 0x55ab00bd
(gdb) p heapmgt->vmheap
$18 = {
start_addr = 0x52d30000 "",
end_addr = 0x5ad30000 ,
(gdb) p /x * dcontext->last_exit
$8 = {
flags = 0xf956, <-- ...FAKE|SPECIAL_EXIT|TARGET_PREFX|JMP|RETURN|INDIRECT == bogus
cti_offset = 0x4054
}
(gdb) p dcontext->upcontext.upcontext.exit_reason
$16 = 0 == EXIT_REASON_SELFMOD
(gdb) p dcontext->last_fragment
$20 = (fragment_t *) 0x52d91d90
(gdb) p /x *dcontext->last_fragment
$13 = {
tag = 0x0,
flags = 0x100, <-- FRAG_FAKE
size = 0x0,
prefix_size = 0x0,
fcache_extra = 0x0,
start_pc = 0x0,
(gdb) p &linkstub_empty_fragment
$15 = (const fragment_t *) 0xb00c4940
(gdb) x/20i dcontext->next_tag
0x52d61b60: str.w r1, [r10, #12]
0x52d61b64: str.w r0, [r10]
0x52d61b68: ldr.w r1, [r10, #20]
0x52d61b6c: and.w r0, r2, #1
0x52d61b70: add.w r0, r0, #2
0x52d61b74: str.w r0, [r1, #432] ; 0x1b0
0x52d61b78: bic.w r2, r2, #1
0x52d61b7c: ldr.w r1, [r10, #76] ; 0x4c
0x52d61b80: and.w r1, r1, r2
0x52d61b84: ldr.w r0, [r10, #80] ; 0x50
0x52d61b88: add.w r1, r0, r1, lsl #3
0x52d61b8c: ldr r0, [r1, #0]
0x52d61b8e: cbz r0, 0x52d61bc6
```
- Why isn't last_fragment set to linkstub_empty_fragment, given that
last_exit has LINK_FAKE set? And why is it linkstub_empty_fragment
that's passed to the subsequent routines on the callstack, if that's
not what's in dcontext?
- Why is last_exit messed up?
- Why is next_tag pointing at ibl?