CVE-2018-8588

rajatd · pleath · commit c76da44c27fc · 2018-11-09T12:42:38.000-08:00
diff --git a/lib/Backend/Lower.cpp b/lib/Backend/Lower.cpp
@@ -3765,13 +3765,11 @@ Lowerer::GenerateProfiledNewScArrayFastPath(IR::Instr *instr, Js::ArrayCallSiteI
         GenerateMemInit(dstOpnd, Js::JavascriptNativeFloatArray::GetOffsetOfWeakFuncRef(), IR::AddrOpnd::New(weakFuncRef, IR::AddrOpndKindDynamicFunctionBodyWeakRef, m_func), instr, isZeroed);
         // Js::JavascriptArray::MissingItem is a Var, so it may be 32-bit or 64 bit.
         uint const offsetStart = sizeof(Js::SparseArraySegmentBase);
-        uint const missingItemCount = size * sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);
-        i = i * sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);
-        for (; i < missingItemCount; i++)
+        for (; i < size; i++)
         {
             GenerateMemInit(
-                headOpnd, offsetStart + i * sizeof(Js::JavascriptArray::MissingItem),
-                IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true),
+                headOpnd, offsetStart + i * sizeof(double),
+                GetMissingItemOpndForAssignment(TyFloat64, m_func),
                 instr, isZeroed);
         }
     }
@@ -3788,7 +3786,7 @@ Lowerer::GenerateProfiledNewScArrayFastPath(IR::Instr *instr, Js::ArrayCallSiteI
         {
             GenerateMemInit(
                 headOpnd, offsetStart + i * sizeof(Js::Var),
-                IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true),
+                GetMissingItemOpndForAssignment(TyVar, m_func),
                 instr, isZeroed);
         }
     }
@@ -4111,12 +4109,11 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi
 
         // Js::JavascriptArray::MissingItem is a Var, so it may be 32-bit or 64 bit.
         uint const offsetStart = sizeof(Js::SparseArraySegmentBase);
-        uint const missingItemCount = size * sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);
-        for (uint i = 0; i < missingItemCount; i++)
+        for (uint i = 0; i < size; i++)
         {
             GenerateMemInit(
-                headOpnd, offsetStart + i * sizeof(Js::JavascriptArray::MissingItem),
-                IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true),
+                headOpnd, offsetStart + i * sizeof(double),
+                GetMissingItemOpndForAssignment(TyFloat64, m_func),
                 instr, isZeroed);
         }
     }
@@ -4126,9 +4123,9 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi
         headOpnd = GenerateArrayObjectsAlloc<Js::JavascriptArray>(instr, &size, arrayInfo, &isZeroed, isNoArgs);
         for (uint i = 0; i < size; i++)
         {
-            GenerateMemInit(
+             GenerateMemInit(
                 headOpnd, offsetStart + i * sizeof(Js::Var),
-                IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true),
+                GetMissingItemOpndForAssignment(TyVar, m_func),
                 instr, isZeroed);
         }
     }
@@ -4159,8 +4156,8 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi
     uint allocationBucketsCount = ArrayType::AllocationBucketsCount;
     uint(*allocationBuckets)[Js::JavascriptArray::AllocationBucketsInfoSize];
     allocationBuckets = ArrayType::allocationBuckets;
-    uint sizeFactor = 1;
-    IRType missingItemType = (arrayInfo && arrayInfo->IsNativeIntArray()) ? IRType::TyInt32 : IRType::TyVar;
+    
+    IRType missingItemType = (arrayInfo ? arrayInfo->IsNativeIntArray() ? IRType::TyInt32 : arrayInfo->IsNativeFloatArray() ? IRType::TyFloat64 : IRType::TyVar : IRType::TyVar);
     IR::LabelInstr * arrayInitDone = IR::LabelInstr::New(Js::OpCode::Label, func);
 
     bool isNativeArray = arrayInfo && (arrayInfo->IsNativeIntArray() || arrayInfo->IsNativeFloatArray());
@@ -4172,9 +4169,7 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi
     }
     else if (arrayInfo && arrayInfo->IsNativeFloatArray())
     {
-        // Js::JavascriptArray::MissingItem is a Var, so it may be 32-bit or 64 bit.
-        sizeFactor = sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);
-        sizeOfElement = sizeof(Js::JavascriptArray::MissingItem);
+        sizeOfElement = sizeof(double);
         GenerateArrayInfoIsNativeFloatAndNotIntArrayTest(instr, arrayInfo, arrayInfoAddr, helperLabel);
     }
     else
@@ -4204,7 +4199,7 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi
 
     for (uint8 i = 0;i < allocationBucketsCount;i++)
     {
-        missingItemCount = allocationBuckets[i][Js::JavascriptArray::MissingElementsCountIndex] * sizeFactor;
+        missingItemCount = allocationBuckets[i][Js::JavascriptArray::MissingElementsCountIndex];
 
         if (i > 0)
         {
@@ -4235,7 +4230,7 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi
     // Ensure no. of missingItems written are same
     Assert(missingItemIndex == missingItemInitializedSoFar);
     // Ensure no. of missingItems match what present in allocationBuckets
-    Assert(missingItemIndex == allocationBuckets[allocationBucketsCount - 1][Js::JavascriptArray::MissingElementsCountIndex] * sizeFactor);
+    Assert(missingItemIndex == allocationBuckets[allocationBucketsCount - 1][Js::JavascriptArray::MissingElementsCountIndex]);
 
     instr->InsertBefore(arrayInitDone);
 
@@ -4363,11 +4358,11 @@ Lowerer::GenerateProfiledNewScFloatArrayFastPath(IR::Instr *instr, Js::ArrayCall
 
     // Js::JavascriptArray::MissingItem is a Var, so it may be 32-bit or 64 bit.
     uint const offsetStart = sizeof(Js::SparseArraySegmentBase) + doubles->count * sizeof(double);
-    uint const missingItem = (size - doubles->count) * sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);
+    uint const missingItem = (size - doubles->count);
     for (uint i = 0; i < missingItem; i++)
     {
-        GenerateMemInit(headOpnd, offsetStart + i * sizeof(Js::JavascriptArray::MissingItem),
-            IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true), instr, isHeadSegmentZeroed);
+        GenerateMemInit(headOpnd, offsetStart + i * sizeof(double),
+            GetMissingItemOpndForAssignment(TyFloat64, m_func), instr, isHeadSegmentZeroed);
     }
     // Skip pass the helper call
     IR::LabelInstr * doneLabel = IR::LabelInstr::New(Js::OpCode::Label, func);
diff --git a/lib/Runtime/Library/JavascriptArray.cpp b/lib/Runtime/Library/JavascriptArray.cpp
@@ -28,7 +28,7 @@ using namespace Js;
         { 8, 0, 0 },    // allocate space for 8 elements for array of length 6,7,8
     };
 
-    const Var JavascriptArray::MissingItem = (Var)FloatMissingItemPattern;
+    const Var JavascriptArray::MissingItem = (Var)VarMissingItemPattern;
 
 #if defined(TARGET_64)
     const Var JavascriptArray::IntMissingItemVar = (Var)(((uint64)IntMissingItemPattern << 32) | (uint32)IntMissingItemPattern);
@@ -2048,6 +2048,8 @@ using namespace Js;
                     {
                         ((SparseArraySegment<Var>*)seg)->elements[i] = JavascriptNumber::ToVar(ival, scriptContext);
                     }
+                    SparseArraySegment<Var>* newSeg = (SparseArraySegment<Var>*)seg;
+                    newSeg->FillSegmentBuffer(seg->length, seg->size);
                 }
                 prevSeg = seg;
             }
@@ -2243,7 +2245,7 @@ using namespace Js;
                     }
                 }
             }
-            if (seg == newSeg && shrinkFactor != 1)
+            if (seg == newSeg)
             {
                 // Fill the remaining slots.
                 newSeg->FillSegmentBuffer(i, seg->size);
diff --git a/lib/Runtime/Library/JavascriptArray.inl b/lib/Runtime/Library/JavascriptArray.inl
@@ -486,6 +486,8 @@ namespace Js
     template<typename T>
     inline void JavascriptArray::DirectSetItemInLastUsedSegmentAt(const uint32 offset, const T newValue)
     {
+        Assert(!SparseArraySegment<T>::IsMissingItem(&newValue));
+
         SparseArraySegment<T> *const seg = (SparseArraySegment<T>*)GetLastUsedSegment();
         Assert(seg);
         Assert(offset < seg->size);
@@ -526,6 +528,8 @@ namespace Js
         const T newValue,
         StElemInfo *const stElemInfo)
     {
+        Assert(!SparseArraySegment<T>::IsMissingItem(&newValue));
+
         SparseArraySegment<T> *const seg = SparseArraySegment<T>::From(head);
         Assert(seg);
         Assert(offset < seg->size);
@@ -1219,6 +1223,8 @@ SECOND_PASS:
     template<typename T>
     void JavascriptArray::DirectSetItem_Full(uint32 itemIndex, T newValue)
     {
+        Assert(!SparseArraySegment<T>::IsMissingItem(&newValue));
+
         DebugOnly(VerifyNotNeedMarshal(newValue));
         this->EnsureHead<T>();
         AnalysisAssert(head);
diff --git a/lib/Runtime/Library/SparseArraySegment.h b/lib/Runtime/Library/SparseArraySegment.h
@@ -147,6 +147,7 @@ namespace Js
         return JavascriptArray::MissingItem;
     }
     template<> Var SparseArraySegment<int32>::GetMissingItemVar();
+    Var SparseArraySegment<double>::GetMissingItemVar();
 
     template<>
     inline bool SparseArraySegment<double>::IsMissingItem(const double* value)
diff --git a/lib/Runtime/Library/SparseArraySegment.inl b/lib/Runtime/Library/SparseArraySegment.inl
@@ -229,6 +229,12 @@ namespace Js
         return JavascriptArray::IntMissingItemVar;
     }
 
+    template<>
+    inline Var SparseArraySegment<double>::GetMissingItemVar()
+    {
+        return (Var)FloatMissingItemPattern;
+    }
+
     template<typename T>
     void SparseArraySegment<T>::FillSegmentBuffer(uint32 start, uint32 size)
     {
diff --git a/lib/Runtime/RuntimeCommon.h b/lib/Runtime/RuntimeCommon.h
@@ -179,6 +179,9 @@ namespace Js
 
 #if FLOATVAR
     const uint64 FloatTag_Value       = 0xFFFCull << 48;
+    const uint64 VarMissingItemPattern = 0x00040002FFF80002; // Float-tagged representation of FloatMissingItemPattern
+#else
+    const int32 VarMissingItemPattern = 0xFFF80002;
 #endif
     const uint64 FloatMissingItemPattern = 0xFFF80002FFF80002;
     const int32 IntMissingItemPattern = 0xFFF80002;

Original file line number	Diff line number	Diff line change
`@@ -3765,13 +3765,11 @@ Lowerer::GenerateProfiledNewScArrayFastPath(IR::Instr *instr, Js::ArrayCallSiteI`
`3765`	`3765`	`GenerateMemInit(dstOpnd, Js::JavascriptNativeFloatArray::GetOffsetOfWeakFuncRef(), IR::AddrOpnd::New(weakFuncRef, IR::AddrOpndKindDynamicFunctionBodyWeakRef, m_func), instr, isZeroed);`
`3766`	`3766`	`// Js::JavascriptArray::MissingItem is a Var, so it may be 32-bit or 64 bit.`
`3767`	`3767`	`uint const offsetStart = sizeof(Js::SparseArraySegmentBase);`
`3768`		`- uint const missingItemCount = size * sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);`
`3769`		`- i = i * sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);`
`3770`		`- for (; i < missingItemCount; i++)`
	`3768`	`+ for (; i < size; i++)`
`3771`	`3769`	`{`
`3772`	`3770`	`GenerateMemInit(`
`3773`		`- headOpnd, offsetStart + i * sizeof(Js::JavascriptArray::MissingItem),`
`3774`		`- IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true),`
	`3771`	`+ headOpnd, offsetStart + i * sizeof(double),`
	`3772`	`+ GetMissingItemOpndForAssignment(TyFloat64, m_func),`
`3775`	`3773`	`instr, isZeroed);`
`3776`	`3774`	`}`
`3777`	`3775`	`}`
`@@ -3788,7 +3786,7 @@ Lowerer::GenerateProfiledNewScArrayFastPath(IR::Instr *instr, Js::ArrayCallSiteI`
`3788`	`3786`	`{`
`3789`	`3787`	`GenerateMemInit(`
`3790`	`3788`	`headOpnd, offsetStart + i * sizeof(Js::Var),`
`3791`		`- IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true),`
	`3789`	`+ GetMissingItemOpndForAssignment(TyVar, m_func),`
`3792`	`3790`	`instr, isZeroed);`
`3793`	`3791`	`}`
`3794`	`3792`	`}`
`@@ -4111,12 +4109,11 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi`
`4111`	`4109`
`4112`	`4110`	`// Js::JavascriptArray::MissingItem is a Var, so it may be 32-bit or 64 bit.`
`4113`	`4111`	`uint const offsetStart = sizeof(Js::SparseArraySegmentBase);`
`4114`		`- uint const missingItemCount = size * sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);`
`4115`		`- for (uint i = 0; i < missingItemCount; i++)`
	`4112`	`+ for (uint i = 0; i < size; i++)`
`4116`	`4113`	`{`
`4117`	`4114`	`GenerateMemInit(`
`4118`		`- headOpnd, offsetStart + i * sizeof(Js::JavascriptArray::MissingItem),`
`4119`		`- IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true),`
	`4115`	`+ headOpnd, offsetStart + i * sizeof(double),`
	`4116`	`+ GetMissingItemOpndForAssignment(TyFloat64, m_func),`
`4120`	`4117`	`instr, isZeroed);`
`4121`	`4118`	`}`
`4122`	`4119`	`}`
`@@ -4126,9 +4123,9 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi`
`4126`	`4123`	`headOpnd = GenerateArrayObjectsAlloc<Js::JavascriptArray>(instr, &size, arrayInfo, &isZeroed, isNoArgs);`
`4127`	`4124`	`for (uint i = 0; i < size; i++)`
`4128`	`4125`	`{`
`4129`		`- GenerateMemInit(`
	`4126`	`+ GenerateMemInit(`
`4130`	`4127`	`headOpnd, offsetStart + i * sizeof(Js::Var),`
`4131`		`- IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true),`
	`4128`	`+ GetMissingItemOpndForAssignment(TyVar, m_func),`
`4132`	`4129`	`instr, isZeroed);`
`4133`	`4130`	`}`
`4134`	`4131`	`}`
`@@ -4159,8 +4156,8 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi`
`4159`	`4156`	`uint allocationBucketsCount = ArrayType::AllocationBucketsCount;`
`4160`	`4157`	`uint(*allocationBuckets)[Js::JavascriptArray::AllocationBucketsInfoSize];`
`4161`	`4158`	`allocationBuckets = ArrayType::allocationBuckets;`
`4162`		`- uint sizeFactor = 1;`
`4163`		`- IRType missingItemType = (arrayInfo && arrayInfo->IsNativeIntArray()) ? IRType::TyInt32 : IRType::TyVar;`
	`4159`	`+`
	`4160`	`+ IRType missingItemType = (arrayInfo ? arrayInfo->IsNativeIntArray() ? IRType::TyInt32 : arrayInfo->IsNativeFloatArray() ? IRType::TyFloat64 : IRType::TyVar : IRType::TyVar);`
`4164`	`4161`	`IR::LabelInstr * arrayInitDone = IR::LabelInstr::New(Js::OpCode::Label, func);`
`4165`	`4162`
`4166`	`4163`	`bool isNativeArray = arrayInfo && (arrayInfo->IsNativeIntArray() \|\| arrayInfo->IsNativeFloatArray());`
`@@ -4172,9 +4169,7 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi`
`4172`	`4169`	`}`
`4173`	`4170`	`else if (arrayInfo && arrayInfo->IsNativeFloatArray())`
`4174`	`4171`	`{`
`4175`		`- // Js::JavascriptArray::MissingItem is a Var, so it may be 32-bit or 64 bit.`
`4176`		`- sizeFactor = sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);`
`4177`		`- sizeOfElement = sizeof(Js::JavascriptArray::MissingItem);`
	`4172`	`+ sizeOfElement = sizeof(double);`
`4178`	`4173`	`GenerateArrayInfoIsNativeFloatAndNotIntArrayTest(instr, arrayInfo, arrayInfoAddr, helperLabel);`
`4179`	`4174`	`}`
`4180`	`4175`	`else`
`@@ -4204,7 +4199,7 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi`
`4204`	`4199`
`4205`	`4200`	`for (uint8 i = 0;i < allocationBucketsCount;i++)`
`4206`	`4201`	`{`
`4207`		`- missingItemCount = allocationBuckets[i][Js::JavascriptArray::MissingElementsCountIndex] * sizeFactor;`
	`4202`	`+ missingItemCount = allocationBuckets[i][Js::JavascriptArray::MissingElementsCountIndex];`
`4208`	`4203`
`4209`	`4204`	`if (i > 0)`
`4210`	`4205`	`{`
`@@ -4235,7 +4230,7 @@ Lowerer::GenerateProfiledNewScObjArrayFastPath(IR::Instr *instr, Js::ArrayCallSi`
`4235`	`4230`	`// Ensure no. of missingItems written are same`
`4236`	`4231`	`Assert(missingItemIndex == missingItemInitializedSoFar);`
`4237`	`4232`	`// Ensure no. of missingItems match what present in allocationBuckets`
`4238`		`- Assert(missingItemIndex == allocationBuckets[allocationBucketsCount - 1][Js::JavascriptArray::MissingElementsCountIndex] * sizeFactor);`
	`4233`	`+ Assert(missingItemIndex == allocationBuckets[allocationBucketsCount - 1][Js::JavascriptArray::MissingElementsCountIndex]);`
`4239`	`4234`
`4240`	`4235`	`instr->InsertBefore(arrayInitDone);`
`4241`	`4236`
`@@ -4363,11 +4358,11 @@ Lowerer::GenerateProfiledNewScFloatArrayFastPath(IR::Instr *instr, Js::ArrayCall`
`4363`	`4358`
`4364`	`4359`	`// Js::JavascriptArray::MissingItem is a Var, so it may be 32-bit or 64 bit.`
`4365`	`4360`	`uint const offsetStart = sizeof(Js::SparseArraySegmentBase) + doubles->count * sizeof(double);`
`4366`		`- uint const missingItem = (size - doubles->count) * sizeof(double) / sizeof(Js::JavascriptArray::MissingItem);`
	`4361`	`+ uint const missingItem = (size - doubles->count);`
`4367`	`4362`	`for (uint i = 0; i < missingItem; i++)`
`4368`	`4363`	`{`
`4369`		`- GenerateMemInit(headOpnd, offsetStart + i * sizeof(Js::JavascriptArray::MissingItem),`
`4370`		`- IR::AddrOpnd::New(Js::JavascriptArray::MissingItem, IR::AddrOpndKindConstantAddress, m_func, true), instr, isHeadSegmentZeroed);`
	`4364`	`+ GenerateMemInit(headOpnd, offsetStart + i * sizeof(double),`
	`4365`	`+ GetMissingItemOpndForAssignment(TyFloat64, m_func), instr, isHeadSegmentZeroed);`
`4371`	`4366`	`}`
`4372`	`4367`	`// Skip pass the helper call`
`4373`	`4368`	`IR::LabelInstr * doneLabel = IR::LabelInstr::New(Js::OpCode::Label, func);`
Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ using namespace Js;`
`28`	`28`	`{ 8, 0, 0 }, // allocate space for 8 elements for array of length 6,7,8`
`29`	`29`	`};`
`30`	`30`
`31`		`- const Var JavascriptArray::MissingItem = (Var)FloatMissingItemPattern;`
	`31`	`+ const Var JavascriptArray::MissingItem = (Var)VarMissingItemPattern;`
`32`	`32`
`33`	`33`	`#if defined(TARGET_64)`
`34`	`34`	`const Var JavascriptArray::IntMissingItemVar = (Var)(((uint64)IntMissingItemPattern << 32) \| (uint32)IntMissingItemPattern);`
`@@ -2048,6 +2048,8 @@ using namespace Js;`
`2048`	`2048`	`{`
`2049`	`2049`	`((SparseArraySegment<Var>*)seg)->elements[i] = JavascriptNumber::ToVar(ival, scriptContext);`
`2050`	`2050`	`}`
	`2051`	`+ SparseArraySegment<Var>* newSeg = (SparseArraySegment<Var>*)seg;`
	`2052`	`+ newSeg->FillSegmentBuffer(seg->length, seg->size);`
`2051`	`2053`	`}`
`2052`	`2054`	`prevSeg = seg;`
`2053`	`2055`	`}`
`@@ -2243,7 +2245,7 @@ using namespace Js;`
`2243`	`2245`	`}`
`2244`	`2246`	`}`
`2245`	`2247`	`}`
`2246`		`- if (seg == newSeg && shrinkFactor != 1)`
	`2248`	`+ if (seg == newSeg)`
`2247`	`2249`	`{`
`2248`	`2250`	`// Fill the remaining slots.`
`2249`	`2251`	`newSeg->FillSegmentBuffer(i, seg->size);`
Original file line number	Diff line number	Diff line change
`@@ -147,6 +147,7 @@ namespace Js`
`147`	`147`	`return JavascriptArray::MissingItem;`
`148`	`148`	`}`
`149`	`149`	`template<> Var SparseArraySegment<int32>::GetMissingItemVar();`
	`150`	`+ Var SparseArraySegment<double>::GetMissingItemVar();`
`150`	`151`
`151`	`152`	`template<>`
`152`	`153`	`inline bool SparseArraySegment<double>::IsMissingItem(const double* value)`
Original file line number	Diff line number	Diff line change
`@@ -229,6 +229,12 @@ namespace Js`
`229`	`229`	`return JavascriptArray::IntMissingItemVar;`
`230`	`230`	`}`
`231`	`231`
	`232`	`+ template<>`
	`233`	`+ inline Var SparseArraySegment<double>::GetMissingItemVar()`
	`234`	`+ {`
	`235`	`+ return (Var)FloatMissingItemPattern;`
	`236`	`+ }`
	`237`	`+`
`232`	`238`	`template<typename T>`
`233`	`239`	`void SparseArraySegment<T>::FillSegmentBuffer(uint32 start, uint32 size)`
`234`	`240`	`{`