regression in drutil_insert_get_mem_addr

While working on https://github.com/DynamoRIO/drmemory/issues/1795 I hit a false positive unaddr due to getting the wrong address from a far ref:

~~Dr.M~~ Error #1: UNADDRESSABLE ACCESS: writing 0xef8444c0-0xef8444c4 4 byte(s)
~~Dr.M~~ # 0 libc.so.6!__GI___ctype_init
~~Dr.M~~ # 1 libc.so.6!_init    
~~Dr.M~~ # 2 ld-linux.so.2!call_init.part.0
~~Dr.M~~ # 3 ld-linux.so.2!_dl_init     
~~Dr.M~~ # 4 ld-linux.so.2!_dl_start_user
~~Dr.M~~ Note: @0:00:06.822 in thread 23665
~~Dr.M~~ Note: instruction: mov    %ecx -> %gs:(%ebx)

It turns out to incorrectly get the address. It's a regression from the "DrMi#2041: improve drutil_insert_get_mem_addr_x8" commit for https://github.com/DynamoRIO/drmemory/issues/2041 which tried to limit when the scratch reg was used on x86:

       L3              65 89 0b             mov    %ecx -> %gs:(%ebx)[4byte]
=>
 +616  m4 @0xe7832150  64 8b 1d 70 00 00 00 mov    %fs:0x00000070[4byte] -> %ebx //getapp
 +623  m4 @0xe783a0c0  64 89 2d 74 00 00 00 mov    %ebp -> %fs:0x00000074[4byte] //spill
 +630  m4 @0xe7833868  64 8b 1d 48 00 00 00 mov    %fs:0x48[4byte] -> %ebx  //gsbase
 +637  m4 @0xe783fba4  65 8d 2b             lea    %gs:(%ebx) -> %ebp
 +640  m4 @0xe7838674  8d 1c 2b             lea    (%ebx,%ebp) -> %ebx

The move of dr_insert_get_seg_base() up above the 1st lea is the problem.

This causes an exit to the slowpath, which computes the correct address. But in my in-progress implementation the slowpath fails to restore the app %ebx value, raising the error.

After the fix:

 +616  m4 @0xe77e109c  64 8b 1d 70 00 00 00 mov    %fs:0x00000070[4byte] -> %ebx
 +623  m4 @0xe7876708  64 89 2d 74 00 00 00 mov    %ebp -> %fs:0x00000074[4byte]
 +630  m4 @0xe786e9bc  65 8d 2b             lea    %gs:(%ebx) -> %ebp
 +633  m4 @0xe786f410  64 8b 1d 48 00 00 00 mov    %fs:0x48[4byte] -> %ebx
 +640  m4 @0xe78786e8  8d 1c 2b             lea    (%ebx,%ebp) -> %ebx

Hmm, we can do better here: one step, by swapping dst and scratch:

 +616  m4 @0xe779d09c  64 8b 1d 70 00 00 00 mov    %fs:0x00000070[4byte] -> %ebx
 +623  m4 @0xe7832708  64 89 2d 74 00 00 00 mov    %ebp -> %fs:0x00000074[4byte]
 +630  m4 @0xe782a9bc  64 8b 2d 48 00 00 00 mov    %fs:0x48[4byte] -> %ebp
 +637  m4 @0xe782b410  8d 1c 2b             lea    (%ebx,%ebp) -> %ebx