Replaced content mapped incorrectly

See https://github.com/rollup/rollup/issues/101. The issue is that if you overwrite anything, the character locations are mapped to -1, which [gets interpreted as 0, 0](https://github.com/Rich-Harris/magic-string/blob/master/src/MagicString/encodeMappings.js#L38-L39), completely incorrectly.
