Fixed a bug in ExprVar.copySubstitute