Fix for uri replace whene uri has fragment. Was adding a second '#'.

BUG=
R=het@google.com

Review URL: https://codereview.chromium.org/2158933003 .
diff --git a/sdk/lib/core/uri.dart b/sdk/lib/core/uri.dart
index 17f290d..b43b3ad 100644
--- a/sdk/lib/core/uri.dart
+++ b/sdk/lib/core/uri.dart
@@ -4207,7 +4207,7 @@
     if (fragment != null) {
       fragment = _Uri._makeFragment(fragment, 0, fragment.length);
     } else if (_fragmentStart < _uri.length) {
-      fragment = _uri.substring(_fragmentStart);
+      fragment = _uri.substring(_fragmentStart + 1);
     }
 
     return new _Uri._internal(
diff --git a/tests/corelib/uri_test.dart b/tests/corelib/uri_test.dart
index a9166be..3d24e2d 100644
--- a/tests/corelib/uri_test.dart
+++ b/tests/corelib/uri_test.dart
@@ -32,6 +32,11 @@
     Expect.equals(uri,
                   Uri.parse(uriText + "#fragment").removeFragment());
   }
+
+  // Test uri.replace on uri with fragment
+  uri = Uri.parse('http://hello.com/fake#fragment');
+  uri = uri.replace(path: "D/E/E");
+  Expect.stringEquals('http://hello.com/D/E/E#fragment', uri.toString());
 }
 
 testEncodeDecode(String orig, String encoded) {