feat(hermes): support HBC v99 (hermes-compiler 260318099, RN 0.88)

HBC 99 keeps the late v98 file header and section layout, so the diff
transform reuses it. The semantic audit behind --verifyHermesBase now
reads the v99 function headers (NumCacheNewObject removed: 36-byte large
header, 7-bit write cache in the small header) and fails closed on the
typed-mode NewTypedObjectWithBuffer. CI runs the real-compiler suite
against hermes-compiler 260318099.0.4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: sunnylqm

.github/workflows/test.yml

@@ -169,6 +169,11 @@ jobs:
             package: hermes-compiler@250829098.0.17
             directory: hermes-compiler
             executable: hermesc/linux64-bin/hermesc
+          - hbc: 99
+            suffix: ""
+            package: hermes-compiler@260318099.0.4
+            directory: hermes-compiler
+            executable: hermesc/linux64-bin/hermesc
     steps:
       - uses: actions/checkout@v7
         with:

src/utils/hbcTransform.ts

@@ -45,7 +45,31 @@ const FUNC_OFFSET_25: DeltaField = { byte: 0, bit: 0, bits: 25 };
 const STRING_OFFSET_23: DeltaField = { byte: 0, bit: 1, bits: 23 };
 const PAIR_OFFSET_32: DeltaField = { byte: 0, bit: 0, bits: 32 };
 
-// v98 两种头部变体共享的段布局
+// 晚期 v98 与 v99 共用的头部计数字段
+const V98_LATE_HEADER_FIELDS = [
+  'fileLength',
+  'globalCodeIndex',
+  'functionCount',
+  'stringKindCount',
+  'identifierCount',
+  'stringCount',
+  'overflowStringCount',
+  'stringStorageSize',
+  'bigIntCount',
+  'bigIntStorageSize',
+  'regExpCount',
+  'regExpStorageSize',
+  'literalValueBufferSize',
+  'objKeyBufferSize',
+  'objShapeTableCount',
+  'numStringSwitchImms',
+  'segmentID',
+  'cjsModuleCount',
+  'functionSourceCount',
+  'debugInfoOffset',
+];
+
+// v98 两种头部变体(及 v99)共享的段布局
 const V98_SECTIONS: SectionDesc[] = [
   {
     name: 'functionHeaders',
@@ -195,28 +219,16 @@ export const HBC_LAYOUTS: HbcLayout[] = [
     // 段布局与早期 v98 相同。
     minVersion: 98,
     maxVersion: 98,
-    headerFields: [
-      'fileLength',
-      'globalCodeIndex',
-      'functionCount',
-      'stringKindCount',
-      'identifierCount',
-      'stringCount',
-      'overflowStringCount',
-      'stringStorageSize',
-      'bigIntCount',
-      'bigIntStorageSize',
-      'regExpCount',
-      'regExpStorageSize',
-      'literalValueBufferSize',
-      'objKeyBufferSize',
-      'objShapeTableCount',
-      'numStringSwitchImms',
-      'segmentID',
-      'cjsModuleCount',
-      'functionSourceCount',
-      'debugInfoOffset',
-    ],
+    headerFields: V98_LATE_HEADER_FIELDS,
+    sections: V98_SECTIONS,
+  },
+  {
+    // Hermes V1 v99(hermes-compiler 260318099,RN 0.88+):文件头与段布局
+    // 同晚期 v98,只改了函数头内部位域(去 NumCacheNewObject)与操作码表,
+    // 二者都不在本变换触及的范围内。
+    minVersion: 99,
+    maxVersion: 99,
+    headerFields: V98_LATE_HEADER_FIELDS,
     sections: V98_SECTIONS,
   },
   {

src/utils/hermes-raw.ts

@@ -68,7 +68,8 @@ export async function readHermesSemanticData(
   if (
     !(
       (resolved.version >= 87 && resolved.version <= 96) ||
-      resolved.version === 98
+      resolved.version === 98 ||
+      resolved.version === 99
     )
   ) {
     throw new UnverifiableHermesBytecode('unsupported semantic HBC version');
@@ -105,7 +106,11 @@ export async function readHermesSemanticData(
   // hbcTransform's file-header variants do not distinguish that function
   // schema change. A compiler upgrade needs independent large/small fixtures;
   // do not infer either schema from numStringSwitchImms or HBC version alone.
-  const shaped = resolved.version === 98;
+  // Audited v99 function schema: hermes-compiler 260318099.0.4 (RN 0.88), the
+  // first HBC bump after that removal, so it always has the 36-byte form.
+  const shaped = resolved.version >= 98;
+  const noCacheNewObject = resolved.version === 99;
+  const largeSize = noCacheNewObject ? 36 : 37;
   const entrySize = shaped ? 12 : 16;
   const headers = section('functionHeaders');
   const functions: FunctionData[] = [];
@@ -122,15 +127,17 @@ export async function readHermesSemanticData(
       const largeOffset = shaped
         ? ((word1 >>> 14) & 0xff) * 0x1000000 + offset
         : (headers.readUInt32LE(at + 8) & 0x1ffffff) * 0x10000 + offset;
-      const large = checkedSlice(bytes, largeOffset, shaped ? 37 : 31);
+      const large = checkedSlice(bytes, largeOffset, shaped ? largeSize : 31);
       offset = large.readUInt32LE(0);
       size = large.readUInt32LE(shaped ? 12 : 8);
       name = large.readUInt32LE(shaped ? 16 : 12);
-      flags = large[shaped ? 36 : 30];
+      flags = large[shaped ? largeSize - 1 : 30];
       fields = shaped
         ? [4, 8, 20, 24, 28].map((p) => large.readUInt32LE(p))
         : [4, 20, 24].map((p) => large.readUInt32LE(p));
-      fields.push(...large.subarray(shaped ? 32 : 28, shaped ? 36 : 30));
+      fields.push(
+        ...large.subarray(shaped ? 32 : 28, shaped ? largeSize - 1 : 30),
+      );
     } else if (shaped) {
       size = word1 & 0x3fff;
       name = (word1 >>> 14) & 0xff;
@@ -141,9 +148,13 @@ export async function readHermesSemanticData(
         word1 >>> 27,
         headers[at + 8],
         headers[at + 9],
-        headers[at + 10] & 63,
-        (headers[at + 10] >>> 6) & 1,
-        headers[at + 10] >>> 7,
+        ...(noCacheNewObject
+          ? [headers[at + 10] & 127, headers[at + 10] >>> 7]
+          : [
+              headers[at + 10] & 63,
+              (headers[at + 10] >>> 6) & 1,
+              headers[at + 10] >>> 7,
+            ]),
       ];
     } else {
       size = word1 & 0x7fff;
@@ -435,6 +446,9 @@ export function normalizeRawHermesFunction(
           'undecodable shape values',
         );
       }
+    } else if (op === 'NewTypedObjectWithBuffer') {
+      // HBC v99 typed-mode buffer user; its literal operands are not decoded.
+      throw new UnverifiableHermesBytecode('typed object literal buffer');
     } else if (op === 'CacheNewObject') {
       if (buffers.layout !== 'shaped' || values.length !== 4) {
         throw new UnverifiableHermesBytecode('unknown cached object operands');

tests/hbc-transform.test.ts

@@ -114,13 +114,34 @@ function buildSyntheticV98(
   return buf;
 }
 
+/** v99 的文件头与段布局同晚期 v98,只有版本号不同。 */
+function buildSyntheticV99(): Buffer {
+  const buf = buildSyntheticV98('late');
+  buf.writeUInt32LE(99, 8);
+  return buf;
+}
+
 describe('hbcTransform', () => {
   test('recognizes fixture version and layout', () => {
     const a = fixture('v96-a.hbc');
     expect(getHbcVersion(a)).toBe(96);
     expect(findLayouts(96)).toHaveLength(1);
     expect(findLayouts(97)).toHaveLength(0);
     expect(findLayouts(98)).toHaveLength(2); // 晚期(20 槽)优先,早期(19 槽)兜底
+    expect(findLayouts(99)).toHaveLength(1);
+    expect(findLayouts(99)[0]!.headerFields).toEqual(
+      findLayouts(98)[0]!.headerFields,
+    );
+    expect(findLayouts(100)).toHaveLength(0);
+  });
+
+  test('v99 is transformed with the late v98 file layout', () => {
+    const buf = buildSyntheticV99();
+    expect(getHbcVersion(buf)).toBe(99);
+    const t = transformHbc(buf);
+    expect(t).not.toBeNull();
+    expect(Buffer.compare(t!, buf)).not.toBe(0);
+    expect(Buffer.compare(transformHbc(t!, true)!, buf)).toBe(0);
   });
 
   test('transform is invertible on real v96 fixtures', () => {
@@ -245,6 +266,7 @@ describe('hbcTransform', () => {
       [fixture('v96-b.hbc'), layout96],
       [buildSyntheticV98('late'), findLayouts(98)[0]!],
       [buildSyntheticV98('early'), findLayouts(98)[1]!],
+      [buildSyntheticV99(), findLayouts(99)[0]!],
     ];
     for (const [buf, layout] of cases) {
       const expected = transformHbcWithLayout(buf, layout, false)!;

tests/hermes-raw.test.ts

@@ -129,7 +129,7 @@ describe.if(hasHermesc)('lossless Hermes operand audit (real compiler)', () => {
     );
   });
 
-  test.skipIf(!hasHermesc || probeHbcVersion(hermesc!) === 98)(
+  test.skipIf(!hasHermesc || probeHbcVersion(hermesc!) >= 98)(
     'classic global lexical declarations resolve restricted-property string IDs',
     async () => {
       const base = compile('lexical-base', 'print("old-base-string");');