Index: include/string
===================================================================
--- include/string
+++ include/string
@@ -2556,10 +2556,13 @@
 }
 
 // replace
+// __sz += __n2 - __n1; in the two functions below can cause unsigned integer overflow,
+// but this is a safe operation, so we disable the check.
 
 template <class _CharT, class _Traits, class _Allocator>
 basic_string<_CharT, _Traits, _Allocator>&
 basic_string<_CharT, _Traits, _Allocator>::replace(size_type __pos, size_type __n1, const value_type* __s, size_type __n2)
+    _LIBCPP_DISABLE_UBSAN_UNSIGNED_INTEGER_CHECK
 {
     _LIBCPP_ASSERT(__n2 == 0 || __s != nullptr, "string::replace received nullptr");
     size_type __sz = size();
@@ -2612,6 +2615,7 @@
 template <class _CharT, class _Traits, class _Allocator>
 basic_string<_CharT, _Traits, _Allocator>&
 basic_string<_CharT, _Traits, _Allocator>::replace(size_type __pos, size_type __n1, size_type __n2, value_type __c)
+    _LIBCPP_DISABLE_UBSAN_UNSIGNED_INTEGER_CHECK
 {
     size_type __sz = size();
     if (__pos > __sz)