diff --git a/ecmascript/compiler/builtins/builtins_array_stub_builder_next_optimization.cpp b/ecmascript/compiler/builtins/builtins_array_stub_builder_next_optimization.cpp
index ecd6dea47f411e7a89dd903bd16211c63d29ffec..686dc9cdf72fb98d250db21610c1ecd2f068a5ee 100644
--- a/ecmascript/compiler/builtins/builtins_array_stub_builder_next_optimization.cpp
+++ b/ecmascript/compiler/builtins/builtins_array_stub_builder_next_optimization.cpp
@@ -2728,7 +2728,7 @@ void BuiltinsArrayStubBuilder::FastFill(GateRef glue, GateRef element, GateRef s
     env->SubCfgEntry(&entry);
     Label exit(env);
     GateRef dstAddr = GetDataPtrInTaggedArray(element, start);
-    CallNGCRuntime(glue, RTSTUB_ID(FillObject), {TaggedCastToIntPtr(dstAddr), value, count});
+    CallNGCRuntime(glue, RTSTUB_ID(FillObject), {glue, element, value, start, count});
     if (needBarrier) {
         CallCommonStub(glue, CommonStubCSigns::BatchBarrier,
             {glue, TaggedCastToIntPtr(element), TaggedCastToIntPtr(dstAddr), count});
diff --git a/ecmascript/compiler/call_signature.cpp b/ecmascript/compiler/call_signature.cpp
index faff89b72dbcc7b2d74567d243a7a60e56b143d9..8292fe25394d5256821579ad5d908eddef829ecb 100644
--- a/ecmascript/compiler/call_signature.cpp
+++ b/ecmascript/compiler/call_signature.cpp
@@ -1990,7 +1990,7 @@ DEF_CALL_SIGNATURE(SortTypedArray)
 
 DEF_CALL_SIGNATURE(FillObject)
 {
-    constexpr size_t paramCount = 3;
+    constexpr size_t paramCount = 5;
     // 3 : 3 input parameters
     CallSignature ObjectFill("FillObject", 0, paramCount,
         ArgumentsOrder::DEFAULT_ORDER, VariableType::VOID());
@@ -1999,6 +1999,8 @@ DEF_CALL_SIGNATURE(FillObject)
     std::array<VariableType, paramCount> params = {
         VariableType::NATIVE_POINTER(),
         VariableType::JS_ANY(),
+        VariableType::JS_ANY(),
+        VariableType::INT32(),
         VariableType::INT32()
     };
     callSign->SetParameters(params.data());
diff --git a/ecmascript/stubs/runtime_stubs.cpp b/ecmascript/stubs/runtime_stubs.cpp
index 4cc4a0055051cf837cafcce7ad17a83c02f33961..400503938472f0ac3734e88dc3f8b8686651aa52 100644
--- a/ecmascript/stubs/runtime_stubs.cpp
+++ b/ecmascript/stubs/runtime_stubs.cpp
@@ -4224,10 +4224,16 @@ void RuntimeStubs::FinishObjSizeTracking(uintptr_t argGlue, JSHClass *cls)
     }
 }
 
-void RuntimeStubs::FillObject(JSTaggedType *dst, JSTaggedType value, uint32_t count)
+void RuntimeStubs::FillObject(uintptr_t argGlue, JSTaggedType elements,
+                                JSTaggedType value, uint32_t start, uint32_t count)
 {
     DISALLOW_GARBAGE_COLLECTION;
+    auto thread = JSThread::GlueToJSThread(argGlue);
+    JSTaggedType *dst = (JSTaggedType*)elements + (TaggedArray::DATA_OFFSET / sizeof(JSTaggedType)) + start;
     std::fill_n(dst, count, value);
+    if (g_isEnableCMCGC) {
+        Barriers::CMCWriteBarrier(thread, (TaggedObject*)(elements), 2, value);
+    }
 }
 
 bool RuntimeStubs::IsTargetBundleName(uintptr_t argGlue)
diff --git a/ecmascript/stubs/runtime_stubs.h b/ecmascript/stubs/runtime_stubs.h
index 9305cb5491a424829fad7c8c4b657fed245ba0b5..5c30fb1cb78e134dedd0a201fbab2185c7b355b7 100644
--- a/ecmascript/stubs/runtime_stubs.h
+++ b/ecmascript/stubs/runtime_stubs.h
@@ -173,7 +173,8 @@ public:
                             JSTaggedType *dst, JSTaggedType *src, uint32_t count);
     static void CopyObjectPrimitive(uintptr_t argGlue, JSTaggedType *dstObj,
                                     JSTaggedType *dst, JSTaggedType *src, uint32_t count);
-    static void FillObject(JSTaggedType *dst, JSTaggedType value, uint32_t count);
+    static void FillObject(uintptr_t argGlue, JSTaggedType elements,
+                            JSTaggedType value, uint32_t start, uint32_t count);
     static void ReverseArray(uintptr_t argGlue, JSTaggedType *dst, uint32_t length);
 
     static JSTaggedValue FindPatchModule(uintptr_t argGlue, JSTaggedValue resolvedModule);
diff --git a/test/moduletest/arrayRelease/arrayRelease.js b/test/moduletest/arrayRelease/arrayRelease.js
index 76a0749fe57ea845cf0fcf95d6aee6ab8e387082..e2a49f97c447578bd80ea4635da3c04e91053595 100644
--- a/test/moduletest/arrayRelease/arrayRelease.js
+++ b/test/moduletest/arrayRelease/arrayRelease.js
@@ -54,4 +54,10 @@
     }
 }
 
+let arr = new Array(24036);
+for(let i=0; i < 300; i++) {
+    let set = new Set(arr);
+    arr.fill(set, 0, 24036);
+}
+
 test_end();
\ No newline at end of file