Update substr_replace.js

Bug fixed with $start and $length negative