`<string>`: `basic_string::replace` fails under ASan when `pos + count > size`, and `count2 < count` 

```cxx
#include <string>

int main()
{
  std::string t = "0123456789ABCDEF"; // large string
  t.replace(0, 30, 7, 'A'); // Address Sanitizer Error: Container overflow.
}
```

Looks like we (I) screwed up the logic here.

Reported in DevCom-10369462