[#130] Fix a field-less compound's size, and correct where the frame sits

RandomAccessReader.GetSize asked for the last child of a node with no children,
which threw for a [Serializable] class with no serialized fields. Such a node
occupies whatever its own size says, normally nothing. Exposed by the new
managedreferences fixture, whose ShapeNoData field sits between the references
and a plain int that has to read correctly after it.

The comments describing the registry frame said it precedes the first field that
can hold a reference. It does not: it leads the declaring class's own data, so
the flag rides that class's first field whether or not that field is a
reference. In the fixture it is a plain int.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: SkowronskiAndrew

Analyzer/PPtrAndCrcProcessor.cs

@@ -99,10 +99,10 @@ public uint Process(long objectId, long offset, long size, TypeTreeNode node)
 
         foreach (var child in node.Children)
         {
-            // From SerializedFile version 25 the registry is a frame in the data ahead of the
-            // marked field, which no node describes. Only a root object's fields carry one. The
-            // frame is not part of that field, so its references get their own path root, named
-            // after the registry as the node-described versions are.
+            // From SerializedFile version 25 the registry is a frame leading the C# class's data,
+            // which no node describes; the flag marks the field it precedes. Only a root object's
+            // fields carry one. The frame is not part of that field, so its references get their own
+            // path root, named after the registry as the node-described versions are.
             if (child.HasSerializedRefs)
             {
                 m_StringBuilder.Clear();

Documentation/unity-content-format.md

@@ -96,8 +96,10 @@ metadata` reports the table as `Shared Subtrees`.
 
 **The `[SerializeReference]` registry.** Up to Unity 6.6 the registry was described by TypeTree
 nodes like any other field, and appeared at the end of the object. From 6.7 it is a self-contained
-frame in the object's data, ahead of the first field that can hold a reference, and no TypeTree node
-describes it. `dump` prints its contents in the same shape either way, so the visible difference is
+frame that leads the C# class's own data - after the built-in fields such as `m_GameObject` and
+`m_Name`, and before the first field declared by the script - and no TypeTree node describes it.
+Putting the registry first is what lets a reader assign each reference as it reads the field,
+instead of patching it afterwards. `dump` prints its contents in the same shape either way, so the visible difference is
 the reported registry `version` (2 before, 3 from 6.7) and where it appears in the output. The new
 format can also express a null reference, which the older ones could not.
 

TextDumper/TextDumperTool.cs

@@ -340,9 +340,9 @@ void RecursiveDump(TypeTreeNode node, ref long offset, int level, int arrayIndex
         {
             foreach (var child in node.Children)
             {
-                // From SerializedFile version 25 the registry is a frame in the data ahead of the
-                // marked field, described by no node. Only a root object's data carries one; the
-                // same type tree read as a registry blob is frameless.
+                // From SerializedFile version 25 the registry is a frame leading the C# class's
+                // data, described by no node; the flag marks the field it precedes. Only a root
+                // object's data carries one; the same tree read as a registry blob is frameless.
                 if (isRootObject && child.HasSerializedRefs)
                     DumpManagedReferenceFrame(ref offset, level + 1);
 

UnityFileSystem.Tests/SerializedFileV26Tests.cs

@@ -164,6 +164,38 @@ public void Registry_Version22_ReadsNodeEntriesAsTheSameShape()
         AssertRegistryContents(m_V22Folder, 2);
     }
 
+    // ManagedReferenceTestBehaviour carries a plain int either side of its [SerializeReference]
+    // fields, and a [Serializable] class with no fields at all. Reading the fields after those is
+    // what catches a reader that mis-sizes either: it reads them shifted rather than failing.
+    [Test]
+    public void Registry_Version26_ReadsFieldsAroundTheFrameAndAFieldLessCompound()
+    {
+        var path = Path.Combine(TestContext.CurrentContext.TestDirectory, "Data",
+            "AssetBundleTypeTreeVariations", "v26", "managedreferences.bundle");
+
+        using var archive = UnityFileSystem.MountArchive(path, "archive:/");
+        var cab = "archive:/" + archive.Nodes.First(n => n.Flags.HasFlag(ArchiveNodeFlags.SerializedFile)).Path;
+
+        using var sf = UnityFileSystem.OpenSerializedFile(cab);
+        using var fileReader = new UnityFileReader(cab, 1024 * 1024);
+
+        var obj = sf.Objects.First(o => o.TypeId == MonoBehaviourClassId && o.Size > 500);
+        var reader = new RandomAccessReader(sf, sf.GetTypeTreeRoot(obj.Id), fileReader, obj.Offset, objectSize: obj.Size);
+
+        // "before" is the field the frame precedes, so it is read past the whole frame.
+        Assert.That(reader["before"].GetValue<int>(), Is.EqualTo(11));
+
+        // "after" follows both the reference fields and the field-less compound.
+        Assert.That(reader["noData"].Size, Is.EqualTo(0));
+        Assert.That(reader["after"].GetValue<int>(), Is.EqualTo(22));
+
+        var registry = reader.Registry;
+        Assert.That(registry.Version, Is.EqualTo(ManagedReferenceRegistry.FrameVersion));
+        Assert.That(registry.Entries.Any(e => e.IsNull), Is.True, "Expected a null reference entry");
+        Assert.That(registry.Entries.Count(e => e.ClassName.EndsWith("Shape")), Is.GreaterThan(1),
+            "Expected several instances of one type, sharing a Types table entry");
+    }
+
     [Test]
     public void Registry_ObjectWithoutReferences_IsNull()
     {

UnityFileSystem/ManagedReferenceRegistry.cs

@@ -25,10 +25,10 @@ public sealed class ManagedReferenceEntry
 
 // The [SerializeReference] instances owned by one serialized object.
 //
-// From SerializedFile version 25 the registry is a self-delimiting frame in the object's data,
-// sitting immediately before the data of the field flagged HasSerializedRefs. It is the first piece
-// of object layout no TypeTree node describes, so the tables inside it cannot be walked the way
-// every other field is.
+// From SerializedFile version 25 the registry is a self-delimiting frame leading the C# class's own
+// data - after the built-in fields, before the first field the script declares, which is the one
+// flagged HasSerializedRefs. It is the first piece of object layout no TypeTree node describes, so
+// the tables inside it cannot be walked the way every other field is.
 //
 // They are not parsed here either: UFS_GetRegistryFrame* wraps the engine's own frame parser, so
 // this class calls into the one implementation that exists rather than becoming a second one. Only

UnityFileSystem/TypeTreeNode.cs

@@ -49,8 +49,9 @@ public class TypeTreeNode
     // True if the field is a ManagedReferenceRegistry
     public bool IsManagedReferenceRegistry => ((int)Flags & (int)TypeTreeFlags.IsManagedReferenceRegistry) != 0;
 
-    // True if the [SerializeReference] registry frame precedes this field's data. Only set on a
-    // root object's fields; the same type tree read as a registry blob carries no frame.
+    // True if the [SerializeReference] registry frame precedes this field's data. The flag rides
+    // the first field of the declaring class, whether or not that field is itself a reference. Only
+    // set on a root object's fields; the same tree read as a registry blob carries no frame.
     public bool HasSerializedRefs => ((int)Flags & (int)TypeTreeFlags.HasSerializedRefs) != 0;
 
     // True if the node stands in for a compound the file stores once and shares between types

UnityFileSystem/TypeTreeReaders/RandomAccessReader.cs

@@ -297,6 +297,12 @@ int GetSize()
         {
             size = m_Reader.ReadInt32(Offset) + 4;
         }
+        else if (m_TypeTreeNode.Children.Count == 0)
+        {
+            // A compound with no fields, which a [Serializable] class with nothing serialized
+            // reaches. It occupies whatever its own node says, normally nothing.
+            size = Math.Max(m_TypeTreeNode.Size, 0);
+        }
         else
         {
             var lastChild = GetChild(m_TypeTreeNode.Children.Last().Name);
@@ -345,8 +351,8 @@ RandomAccessReader GetChild(string name)
         {
             var child = m_TypeTreeNode.Children[i];
 
-            // From SerializedFile version 25 the registry is a frame in the data ahead of the marked
-            // field, described by no node, so the field's data starts past it. Only its size is
+            // From SerializedFile version 25 the registry is a frame leading the C# class's data,
+            // described by no node, so the marked field's data starts past it. Only its size is
             // needed to get there; Registry reads the tables if anyone asks for them.
             if (m_IsRoot && child.HasSerializedRefs)
             {