FSFS7 repository corruption during commit with background upgrade

I was looking how fsfs upgrade code works and found particular fsfs7
log-addressing repository corruption bug:
0. Repository has 999 revisions.
1. Client begins committing some data to fsfs v6 repository through Apache
2. Apache web server opens svn_fs_t, reads format file. At this point
   repository has format 6 and uses physical (classic) addressing.
3. Client changes txn content
4. Before committing change, admin upgrades this repository to fsfs7. FSFS
   upgrade code marks that log-addressing will be available from next shard,
   i.e. from revision 1000.
5. Apache web server starting committing txn: obtaining write-lock and writes
   protorev for r1000. Since svn_fs_t instance was cached for connection so
   it didn't know that revision 1000 should be log addressing and writes
   physical addressing revision without any error (!)

Commit succeeded, but repository is unreadable.

I'm attaching patch with test reproducing this issue. The commit may
fail in maintainer mode because txn will be verified before commit.

-- 
Ivan Zhakov