Quo Vadis, Shumway? (Status August '14)

Motivation

• Research project driving the web platform forward
• Product replacing the Flash plugin with upsides to stability, security, privacy and user experience

Status

Research

• Identified lots of performance and correctness issues in JS and GFX
• Identified shortcomings of the web platform, proposed and drove solutions
• Both ongoing

Product

• Far beyond proof of concept, nearing production-readiness
• Last few months: moved from fast iteration with lots of breakage and varying code quality to solid basis
• Split into SWF parsing/script execution and rendering part
• Canvas2D and WebGL rendering backends
• can play most banners and many games, casual content mostly correctly
• working with security folks to have solid confidence in that area
• in Nightly, disabled by default

Community / External Usage

• Flash security researchers doing mass penetration testing for SWFs
• Prezi using Shumway to render SWFs in their 2D presentations
• Embeddable in websites / usable for "porting" content to the web
• Script execution works in the shell, node.js

Next Steps

• Move script execution into an e10s process
• Parallelize script execution and rendering
• Speed up startup
• Optimize memory usage
• Whitelist specific SWFs and/or types of content (i.e., banners)
• Iterate on compatibility
• Enable by default on Nightly
• Collect telemetry
• Stabilize
• Ship it

Where do we need other teams' support?

• Integration into cookie management
• Testing
• User Interface
• IT help with improving our testing infrastructure
• probably e10s hand-holding
• ongoing support from JS and GFX teams