Btrfs: fix two use-after-free bugs with transaction cleanup