Fix int overflow in SpannableStringBuilder.replace

During the offset calculation for selection, SpannableStringBuilder
had an overflow while multiplying two int values. This CL uses long to
calculate the multiplication, and also checks for overflow after
casting the final result into int again.

Bug: 29108549
Change-Id: I11eff4677916701074b38bc5214730fe704707c4