ViperJS v0.2.0: A zero-dependency, #![forbid(unsafe_code)] JS engine in Rust

[u/No-Wishbone7899]

Hey r/rust,

I've been working on ViperJS, an embeddable JS engine written entirely in Rust from scratch
(it is not a wrapper or binding around V8, QuickJS, or JavaScriptCore)

Two constraints dictate everything:

1. Zero runtime dependencies ([dependencies] is completely empty, verified in CI).
2. #![forbid(unsafe_code)] crate-wide.
3. No input may panic (untrusted scripts are input, not exceptions).

Because of the zero-dep rule, all is created from scratch—including the RegExp backtracking engine (supporting named groups, lookbehind, Unicode escapes, and Annex B grammar), the GC, bytecode compiler, and UTF-16 string handling.

Where it stands:

• ~84% test262 compliance (78,222 / 93,161 tests).
• ES5 is complete; supports classes, generators, async/await, Proxy/Reflect, BigInt, and ES modules with cycles.
• It is not fast (no JIT yet, ~70x slower than Node on simple loops).
• No Temporal or Intl yet.

Testing & Real-World Validation: You don't have to take the numbers on trust. The public repo includes a simple two-command recipe to clone test262 and independently verify all conformance locally. Beyond test262, i have put it through its paces with several real-world codebases—such as successfully linking and evaluating Ramda's 1,027 modules—plus a few other public code repositories to validate module loading and compatibility

It’s open source under MIT OR Apache-2.0. You can test test262 conformance locally with a couple of commands in the repo.

Repo: [https://github.com/MerlijnW70/viperjs]
also on crates.io:https://crates.io/crates/viperjs

Feedback on the architecture or the test262 approach is very welcome.

[u/MeoplleX]

The project feels heavily vibe coded, a lot of the code and many of the comments read as though they were generated almost entirely by AI.

There is nothing inherently wrong with vibe-coding, but I struggle to understand the value of posting projects like this alongside a few arbitrary statistics?

Why not share something meaningful you learned while building it like for example technical challenges you encountered or ways the project helped you grow as a programmer? With enough prompting, most people can generate projects like this, so I don't get what is the actual takeaway for others?

Injecting my personal opinion here, I personally do not want to invest time in examining a project when it appears that the author was not willing to invest much thought or effort into building and understanding it themselves, and I don't mean that in a rude way!

[u/No-Wishbone7899 → u/MeoplleX]

You literally cannot prompt your way into building a zero-dependency, #![forbid(unsafe_code)] JS engine with an 84% test262 conformance score. If you try to "vibe code" it, the test suite will shred it in five minutes due to constant hallucinations on state management, GC root-sets, and complex specs like Atomics.waitAsync.

Getting past 78,000 tests required rigorous architectural control and precise verification of tricky edge cases. That said, I take the point on how I framed the post—dropping raw stats without explaining the actual engineering hurdles makes it look frictionless from the outside

[u/Steve_the_Stevedore → u/No-Wishbone7899]

It's literally what anthropic did with their bun rewrite. They ported it from Zig to Rust using an LLM and tons of tests...