Fix String.sub! bug