Array.prototype.fill bug fix

negative end index