Twister Ice Fun (also known as Twister Game) hangs while loading the level.

[fsvgm777]

Describe the bug

In Ruffle, the game hangs on this screen upon clicking on "HRÁT":

Expected behavior

The game is supposed to load the level proper upon clicking on "HRÁT".

Affected platform

Desktop app

Operating system

Windows 10 x64

Browser

No response

Additional information

It should be noted that Adobe Flash Player does not have the issue.

The game itself comes with an external game.dat, which I might assume it tries to load upon clicking on "HRÁT", but it doesn't load it in Ruffle.

Here's a ZIP with the game and the game.dat twistergame.zip :

[Herschel]

The game.dat variables are loaded into _root, but the game.dat includes: ...&constructor=[type Function]&__proto__=[object Object]&... which wipes out the proto of _root and causes havoc. Deleting those variables from game.dat causes the game to function.

When proto gets stomped, _root.gotoAndStop(5); has no effect, and the loading screen gets stuck.

[Herschel]

Looked into this a bit more, and the Flash Player behavior is really bizarre. Display objects in AVM1 seem to be able to "heal" their proto property:

• Flash Player will indeed overwrite _root.__proto__ when loading variables into _root in this way.
• However, if you later try to access a property on _root, the __proto__ magically fixes itself somehow.
• Specifically it seems like this occurs for StageObjects. Normal objects don't heal in this way.
• This happens if you set __proto__ to a primitive value. If you do _root.__proto__ = {};, it sticks forever.
• The "healing" seems to be triggered when accessing a non-existent property on the clip, where prototype search would happen. Flash notices that the prototype is busted, and resets it.

Sample:

trace(_root.__proto__); // [object Object]
_root.__proto__ = "bad";
trace(_root.__proto__); // "bad"
trace(_root.__proto__.gotoAndStop); // undefined

trace(_root.gotoAndStop); // [type Function] -- proto healed???

trace(_root.__proto__); // [object Object]
trace(_root.__proto__.gotoAndStop); // [type Function]

proto-healing.zip

Likely I'm missing some part of the behavior here, so this needs more investigation.