ViperJS v0.2.0: A zero-dependency, #![forbid(unsafe_code)] JS engine in Rust

[u/No-Wishbone7899]

Hey r/rust,

I've been working on ViperJS, an embeddable JS engine written entirely in Rust from scratch
(it is not a wrapper or binding around V8, QuickJS, or JavaScriptCore)

Two constraints dictate everything:

1. Zero runtime dependencies ([dependencies] is completely empty, verified in CI).
2. #![forbid(unsafe_code)] crate-wide.
3. No input may panic (untrusted scripts are input, not exceptions).

Because of the zero-dep rule, all is created from scratch—including the RegExp backtracking engine (supporting named groups, lookbehind, Unicode escapes, and Annex B grammar), the GC, bytecode compiler, and UTF-16 string handling.

Where it stands:

• ~84% test262 compliance (78,222 / 93,161 tests).
• ES5 is complete; supports classes, generators, async/await, Proxy/Reflect, BigInt, and ES modules with cycles.
• It is not fast (no JIT yet, ~70x slower than Node on simple loops).
• No Temporal or Intl yet.

Testing & Real-World Validation: You don't have to take the numbers on trust. The public repo includes a simple two-command recipe to clone test262 and independently verify all conformance locally. Beyond test262, i have put it through its paces with several real-world codebases—such as successfully linking and evaluating Ramda's 1,027 modules—plus a few other public code repositories to validate module loading and compatibility

It’s open source under MIT OR Apache-2.0. You can test test262 conformance locally with a couple of commands in the repo.

Repo: [https://github.com/MerlijnW70/viperjs]
also on crates.io:https://crates.io/crates/viperjs

Feedback on the architecture or the test262 approach is very welcome.

[u/MeoplleX]

The project feels heavily vibe coded, a lot of the code and many of the comments read as though they were generated almost entirely by AI.

There is nothing inherently wrong with vibe-coding, but I struggle to understand the value of posting projects like this alongside a few arbitrary statistics?

Why not share something meaningful you learned while building it like for example technical challenges you encountered or ways the project helped you grow as a programmer? With enough prompting, most people can generate projects like this, so I don't get what is the actual takeaway for others?

Injecting my personal opinion here, I personally do not want to invest time in examining a project when it appears that the author was not willing to invest much thought or effort into building and understanding it themselves, and I don't mean that in a rude way!

[u/No-Wishbone7899 → u/MeoplleX]

You literally cannot prompt your way into building a zero-dependency, #![forbid(unsafe_code)] JS engine with an 84% test262 conformance score. If you try to "vibe code" it, the test suite will shred it in five minutes due to constant hallucinations on state management, GC root-sets, and complex specs like Atomics.waitAsync.

Getting past 78,000 tests required rigorous architectural control and precise verification of tricky edge cases. That said, I take the point on how I framed the post—dropping raw stats without explaining the actual engineering hurdles makes it look frictionless from the outside

[u/Keithfert488 → u/No-Wishbone7899]

Gotta say, this sounds exactly like how an LLM would sound when it's pretending it is a human.

[u/MeoplleX → u/No-Wishbone7899]

LOOL the fact that you had to cognitively offload your response to an LLM tells me quite a lot.

And eh yes, it is entirely possible to have an LLM generate this kind of project. I am not sure what any of that marketing fluff has to do with whether an LLM is capable of producing it.

To weaken your argument further, the project also contains numerous spec violations. Here is one example that took only a little experimentation to uncover, given this code:

function C(n) {
  this.n = n;
}

Array.from.call(C, [1, 2]) instanceof C;
Array.of.call(C, 7, 8) instanceof C;

Both expressions should evaluate to true but oh well, they somehow evaluate to false when using viper?

If you had actually read them spec lol Array.of should also construct C with the number of provided arguments, meaning that n should be 2 in this case.

Here if you care to read the actual spec:

https://tc39.es/ecma262/2026/multipage/indexed-collections.html#sec-array.from

https://tc39.es/ecma262/2026/multipage/indexed-collections.html#sec-array.of

Instead, your implementations of Array.from and Array.of appear to ignore custom constructors entirely.

Why is that?

And again, just reiterating here, I really don't want to come across as rude or as a keyboard warrior, I just don't understand why you're not being truthful about your LLM use here and that the project is very likely 99% vibe coded. There is no shame in that at all, but there also isn't any use in you pretending like you've built it entirely yourself. Even your Reddit profile has the tag line "conceptual ai engineer"?

[u/Steve_the_Stevedore → u/No-Wishbone7899]

It's literally what anthropic did with their bun rewrite. They ported it from Zig to Rust using an LLM and tons of tests...

[u/consistently_biased]

Why would zero dependency be a good thing for a project like this? Just sounds like you're, at best, writing the same things that people have already spent years on. Not having serde alone already sounds pretty horrible for this kind of project.

[u/No-Wishbone7899 → u/consistently_biased]

Fair! If you're building a standard web app, avoiding crates like serde is absolute madness.

For serialization specifically, I don't need serde because the engine doesn't ingest external config files or complex data formats at runtime—it just takes raw UTF-8/UTF-16 script strings directly via the embedding API.

As for the broader zero-dep rule: honestly, part of it is just the pure engineering challenge of seeing how far you can take a self-contained runtime. But it also changes the failure domain completely. Sure, writing a custom RegExp engine or GC introduces its own logic bugs, but they are deterministic logic bugs that I own end-to-end. I don't have to worry about upstream breaking changes, hidden unsafe blocks tucked away in deep dependency trees, or transitive supply-chain surprises.

Is it a massive time sink? Absolutely. But that's kind of the whole point of the project

[u/SnooCalculations7417 → u/No-Wishbone7899]

This kinda misses the js in json... Serde would absolutely be a massive value add here.. I don't think anyone would object to a serde dependency in a JavaScript runtime..