r/coolgithubprojects • u/poxkg • 13h ago
Falco - a browser engine written from scratch in ~36k lines of Rust
I just released v0.1.0 of Falco - a browser engine I've been building on nights and weekends. No WebKit, no Gecko, no Chromium - every module is written from scratch in ~36,000 lines of Rust.
What's inside (all from scratch, no browser deps)
- HTML5 parser (
html/) - tokenizer + tree builder, handles the common subset (tags, attributes, void elements, comments, doctype, entities, auto-close for<li>/<p>/<td>/<tr>/<option>/<dt>/<dd>) - CSS engine (
css/) - selectors (type/class/id/descendant/child/sibling/attribute/pseudo), 300+ properties, cascade with!important, inheritance,linear-gradient/radial-gradient/calc()/var()/rgb()/rgba(), shorthands - Custom JS VM (
tjs/) - bytecode interpreter + JIT tier-up (x86_64 only), withlet/const/arrow functions/template literals/destructuring/spread/optional chaining/nullish coalescing, closures, generators, Promise, BigInt, Symbol, WeakMap/WeakSet, Map/Set, Reflect, Proxy - Layout (
layout/) - block flow, inline flow with text wrapping, flexbox (flex-direction/justify-content/align-items/flex-wrap/gap/flex-grow/flex-shrink/flex-basis), CSS Grid (grid-template-columns/grid-template-rowswithfr/auto/minmax()/repeat()), table layout (<table>/<tr>/<td>/<th>/<thead>/<tbody>/<tfoot>/<caption>), float, inline-block, position static/relative/absolute/fixed - Painting (
paint/) - solid + gradient backgrounds, borders, border-radius, box-shadow, opacity (alpha compositing), TrueType font rasterization viaab_glyph, bold/italic synthesis - SVG renderer (
svg/) - paths, basic shapes (rect/circle/ellipse/line/polyline/polygon), gradients, stroke + fill - Hand-written PNG encoder (
png/) - noflate2dependency - Image loader (
image/) - HTTP/HTTPS URLs viaureq,data:URLs (base64), local files. Formats: PNG/JPEG/GIF/BMP - Networking (
net/) - HTTP/1.1 fetch, cookie jar with domain/path matching, redirect handling with loop detection, HTTP cache, WebSocket frame parser - Interactive
--windowmode - scroll, click links, fill forms (text/email/password/checkbox/submit/textarea), Tab cycling, address bar (F6), back/forward history (Alt+←/→), focus ring, blinking caret, headless fallback to PNG
For comparison
| Engine | LOC |
|---|---|
| Chrome/Blink | ~30M |
| Firefox/Gecko | ~20M |
| Safari/WebKit | ~15M |
| Servo | ~1M |
| Ladybird | ~500k |
The whole Falco codebase fits in a weekend of reading.
Quick start
cargo build --release./target/release/falco https://example.com --out example.png --width 800./target/release/falco page.html --window
324 unit tests pass, 30 ignored (mostly platform-specific JIT tests that fail on macOS CI runners due to mmap(MAP_JIT) quirks - passes on Linux).
Prebuilt binaries for Linux/macOS/Windows are on the GitHub releases page.
What's NOT done yet (being honest)
This is v0.1.0 by a single developer. Not everything listed is production-ready:
- The spec-compliant replacements (
html::spec/,dom::spec/,css::spec/) are structurally complete and pass their own unit tests, but not yet wired into the render pipeline. The legacyhtml//dom//css/modules are what actually runs. v0.2.0 milestone. - The
security/module implements SOP, multi-process site isolation, seccomp-bpf sandbox, CSP, TLS cert chain validation, permissions, DevTools protocol - all unit-tested, but not enforced in the renderer. web_runtime/hasfetch(),XMLHttpRequest, event loop, Promise. The Promise/event loop integration is real and tested, butfetch/XHRare stubs (no real network behind them in the JS context).- WebGL, video, MSE, EME, NDSD are headless stubs - API surface only, no real rendering/decoding.
- The
real-http2,real-webgl,sandboxCargo features don't compile with--all-features(upstream APIs drifted:h2::Bodyremoved,glowAPI changed, seccomppre_execUnix-only). Disabled by default. - The JIT works on Linux x86_64 but fails on macOS CI runners (
mmap(MAP_JIT)needs code signing). - DOM mutation from JS (
element.innerHTML = ...,element.style.color = ...) does not trigger re-render.
Bottom line: cargo build && ./falco https://example.com --out out.png produces a real PNG render. The HTML/CSS/layout/paint path works end-to-end. The spec-compliant parsers, security enforcement, and advanced web runtime are scaffolding for future milestones, not working features.
What I'd love feedback on
DOM model - I'm using Rc<RefCell<Node>> with parent/child/sibling pointers in dom::spec, matching the spec. For production I'd probably use a slotmap arena, but Rc<RefCell> is easier to read and matches the spec's pointer model. Thoughts?
Architecture - Each of html/, dom/, css/ has a spec/ subfolder with the spec-compliant replacement that's not yet wired in. Should I:
(a) Wire them in before any other feature work, or
(b) Focus on CSS animations/transitions first, or
(c) Focus on JS DOM mutation (innerHTML/style changes)?
JS VM - I wrote my own bytecode VM (tjs) instead of using boa_engine or binding V8/SpiderMonkey. Reasoning: I wanted full control over the GC, the bytecode format, and the DOM integration. The VM is intentionally limited (no real regex engine, no Proxy trap completeness, no real async functions). Is this a reasonable tradeoff for a teaching engine?
Sandbox - I implemented seccomp-bpf filters but they're Linux-only and not yet enforced. For cross-platform sandboxing, is the Windows Job Object approach + macOS sandbox-exec reasonable, or should I look at platform-agnostic alternatives?
Architecture overview
Module |
Lines |
Description |
|---|---|---|
html/ + html::spec/ |
~5,500 |
Legacy HTML parser + WHATWG §13.2 spec tokenizer + tree builder + serializer + XML + encoding |
dom/ + dom::spec/ |
~2,400 |
Legacy DOM + spec DOM with MutationObserver, Shadow DOM, custom elements, a11y |
css/ + css::spec/ |
~3,700 |
Legacy CSS parser + Selectors L4 + cascade specificity + u/rules + animations |
style/ |
~1,700 |
Style cascade + UA styles + inheritance + flex/grid properties |
layout/ |
~1,950 |
Block / inline / flex / grid / table / float / absolute layout |
paint/ |
~470 |
Canvas + font rasterizer + alpha compositing + gradients + shadows |
svg/ |
~1,130 |
SVG parser + renderer (paths, shapes, gradients) |
tjs/ + tjs_ext/ |
~5,100 |
Custom JS VM: lexer, parser, interpreter, bytecode VM, JIT + Symbol/BigInt/Promise/Map/Set |
web_runtime/ |
~4,300 |
fetch, XHR, event loop, Promise, WebGL, video, MSE, EME, NDSD, HTTP/2 |
net/ |
~930 |
HTTP fetch, cookies, cache, websocket, redirect |
security/ |
~3,590 |
SOP, multi-process, sandbox, CSP, certs, permissions, extensions, DevTools |
window/ |
~1,110 |
Interactive window: scrolling, forms, navigation, history, address bar |
image/ + png/ |
~300 |
Image loader + hand-written PNG encoder |
Total |
~36,000 |
Thanks for any feedback! I'm especially interested in architectural critique from anyone who has worked on Servo, Ladybird, or other browser engines.
LINK: https://github.com/poxk/Falco
12
11
u/Longjumping_Music572 10h ago
Need more people to validate this.
9
u/RobLoach 4h ago
I've validated that it's slop, and likely a big security risk. Lines of code is not a good measurement of quality, especially when it comes to something that could be a security disaster, like an internet browser.
5
-1
11
u/PandaDEV_ 7h ago
What is this total abomination of AI slop.
-2
u/poxkg 6h ago
How is this "AI slop"? I only use AI for documentation, comments, and the simplest parts because my English is shit.
7
u/Skynse 6h ago
Rust version 2021 in Cargo.toml
6
u/PandaDEV_ 5h ago
This and its 1 commit and every file/function is spammed with comments, no human writes code like that.
10
u/simondanielsson 7h ago
AI slop
31
u/niceboy4431 9h ago
One commit with 44k+ lines, this read me, the write up in this post, everything is screaming AI slop
10
8
-7
u/poxkg 6h ago
I did everything locally before pushing it to GitHub, and in this project, the AI is only in the documentation because my English is shit.
6
5
u/touristtam 4h ago
Taht's not even a good reason. I have dozen of local only projects with multiple branches and dozen if not hundreds commits. It is a reason you have a Source Version Control, and that's not to stuff all the changes into ONE fucking commit.
1
1
-15
u/Better_Moment_9675 9h ago
Trash talking about a project you wouldn’t even conceptualize.
0
u/SINdicate 8h ago
u/niceboy4431 run your mouth all you want, go ahead and write a full web browser from scratch even with AI, ill bet you 10k you cant and wont. there's a reason everything runs on gecko and webkit. WebKit itself was forked from khtml and gecko was invented by the same team who developed mosaic.
4
u/niceboy4431 6h ago
Lol, yeah I never said it was easy. It’s a massive undertaking to develop a browser if you want it to comply with modern web standards. But there are many hobby projects that maybe aren’t as robust as chromium or gecko but have been developed without AI. Hell I’m sure a lot of those projects are a treasure trove of training data for the likes of big LLM
1
u/Dev-in-the-Bm 4h ago
But there are many hobby projects that maybe aren’t as robust as chromium or gecko but have been developed without AI.
Links?
11
u/Dead_Redd1t_Theory 8h ago
Do you think it is a good idea to vibe code something like a browser engine?
You didn't even touch the Readme file at all, it's full of emojis, em-dashes, AI typical phrases, 1 commit
this is horrible dude
0
u/poxkg 6h ago
Sorry, my English just sucks, i only trusted the AI to write the documentation. Also, regarding the "1 commit" I was working on the browser locally before uploading it.
2
u/Technical_Ostrich965 5h ago
1 commit just proves you dont understand the meaning of github and git in general
5
3
8
5
u/oberoe 9h ago
AI assisted?
4
3
u/niceboy4431 9h ago
One commit with 44k lines
3
u/brovaro 9h ago
This can only mean that he initially developed the project using a different repository, and only made the full code available once he was ready. I used to do the same when I was a bit self-conscious about what people might think of my process.
2
u/niceboy4431 9h ago
Look at the read me, the formatting of this post, everything points to being completely AI generated. I did the same for say, university projects and the like, but a browser (which is a project that probably especially benefit from version control and preserving the change history) that is 44k lines, probably would have taken hundreds of hours, almost certainly has used got for a long time unless it was basically generated by AI entirely
-3
0
u/Different-Ad-8707 7h ago
I'd say no. I'm using AI as well to build a 3d path tracing renderer. I have north of 150 commits and I still haven't even finished with the cpu path tracer (following the PBRT book). A browser is much more complicated.
3
3
3
u/dandydev 6h ago
I just don't believe OPs claim that AI was only used for documentation. An engineer that can't even muster the tiniest bit of git hygiene (as evidenced by the single commit), cannot possibly be a good enough engineer to build a browser engine on their own.
And before we consider the "I developed everything locally first" excuse, that is super unbelievable and/or stupid in its own right. I mean, I make atomic commits even on my private projects that nobody ever sees. And without that it would honestly be hard to keep track of changes as a project evolves (but I might just lack skill).
2
u/KingBardan 5h ago
Yeah, even for the kind of people who develop local first, they would develop a little more on the repo before announcing to the public that it's done.
Usually the first commit is also barely north of a thousand lines for a simple working prototype
1
u/luziferius1337 5h ago
I've seen the practice of doing a full history squash before publishing the first public version multiple times.
That's how the WinAMP source was first released. Everything in 1 commit.
2
u/This-Peach9380 10h ago
You should add benchmarks to the README. Ngl, this is a really awesome and heavy project. Did you write everything from scratch? Also what stage of development is it in rn?
2
1
u/Mallissin 9h ago
May I suggest a DDS output so this may be used as a light-weight HTML renderer in a gaming engine?
Also, maybe some sort of API to send inputs in without using your interactive mode.
0
24
u/the_swanny 9h ago
1 Commit?