I had a couple of crashes in quick succession due to an invalid
Curl_tree::larger, probably due to a double remove not caught by
Curl_splayremovebyaddr. Although the patch doesn't fix the (possibly
non-exisent) real bug, it does make splay more robust.

It is a cleaned up version of the one I made while looking for the
previous bug. Can't say if it will fixes my problem as I cannot
reproduce the crashes.

Rakshasa