btrfs: fix use-after-free due to race between replace start and cancel