dr_insert_clean_call with where=NULL silently adding instrs at wrong spot instead of failing

Created by: jordanConrad1145

Inserting a clean call at the end of an instruction list doesn't behave as expected. When instr_get_next(instr) == NULL the call seems to be executed before instr is hit

The goal is to change this mov rcx, [rsi+8] call (some function) **end of bb

To this

mov rcx, [rsi+8] call 1st instrumentation call (some function) call 2nd instrumentation **end of bb

End Behavior:

mov rcx, [rsi+8] call 1st instrumentation call 2nd instrumentation call (some function) **end of bb

Basic reproduce code. Notice how calls never goes above 0 unless ret is removed

dr_emit_flags_t on_bb_instrument(void *drcontext, void *tag, instrlist_t *bb, instr_t *inst, bool for_trace, bool translating, void *user_data) {

if (instr_is_app(inst)) {
	if(instr_is_call_direct(inst)) {
		dr_insert_clean_call(drcontext, bb, instr, call, false, 0);
		dr_insert_clean_call(drcontext, bb, instr_get_next(instr), ret, false, 0);
	}
}
else {
	dr_printf("not app pc\n");
}

return DR_EMIT_DEFAULT;

}

uint calls = 0; void call(Instr_S *CurrentInstr) { dr_printf("%d\n", calls); calls++; }

void ret() { calls--; }