Fix a bug in `SubArray` composition.

Like 50% of all programming errors, it is an off-by-one.

Big thanks to @mmun for catching this.

See http://jsbin.com/ImEsOWu/2/edit