diff --git a/lisp/subr.el b/lisp/subr.el
index 0f72b382fe8..0de9ac5d960 100644
--- a/lisp/subr.el
+++ b/lisp/subr.el
@@ -4439,8 +4439,8 @@ Unless optional argument INPLACE is non-nil, return a new string."
       (unless (= start pos)
         (push (substring instring start pos) result))
       (push tostring result)
-      (setq start (+ start (length fromstring))))
-    (unless (= start pos)
+      (setq start (+ pos (length fromstring))))
+    (unless (= start (length instring))
       (push (substring instring start pos) result))
     (apply #'concat (nreverse result))))
 
diff --git a/test/lisp/subr-tests.el b/test/lisp/subr-tests.el
index 14870d4adab..fa728e430fc 100644
--- a/test/lisp/subr-tests.el
+++ b/test/lisp/subr-tests.el
@@ -462,9 +462,9 @@ See https://debbugs.gnu.org/cgi/bugreport.cgi?bug=19350."
                  "foozotbar"))
 
   (should (equal (replace-in-string "\377" "x" "a\377b")
-                 "axxb"))
+                 "axb"))
   (should (equal (replace-in-string "\377" "x" "a\377ø")
-                 "axxø")))
+                 "axø")))
 
 (provide 'subr-tests)
 ;;; subr-tests.el ends here