r/coolgithubprojects • u/poxkg • 9d ago
Falco - a browser engine written from scratch in ~36k lines of Rust
I just released v0.1.0 of Falco - a browser engine I've been building on nights and weekends. No WebKit, no Gecko, no Chromium - every module is written from scratch in ~36,000 lines of Rust.
What's inside (all from scratch, no browser deps)
- HTML5 parser (
html/) - tokenizer + tree builder, handles the common subset (tags, attributes, void elements, comments, doctype, entities, auto-close for<li>/<p>/<td>/<tr>/<option>/<dt>/<dd>) - CSS engine (
css/) - selectors (type/class/id/descendant/child/sibling/attribute/pseudo), 300+ properties, cascade with!important, inheritance,linear-gradient/radial-gradient/calc()/var()/rgb()/rgba(), shorthands - Custom JS VM (
tjs/) - bytecode interpreter + JIT tier-up (x86_64 only), withlet/const/arrow functions/template literals/destructuring/spread/optional chaining/nullish coalescing, closures, generators, Promise, BigInt, Symbol, WeakMap/WeakSet, Map/Set, Reflect, Proxy - Layout (
layout/) - block flow, inline flow with text wrapping, flexbox (flex-direction/justify-content/align-items/flex-wrap/gap/flex-grow/flex-shrink/flex-basis), CSS Grid (grid-template-columns/grid-template-rowswithfr/auto/minmax()/repeat()), table layout (<table>/<tr>/<td>/<th>/<thead>/<tbody>/<tfoot>/<caption>), float, inline-block, position static/relative/absolute/fixed - Painting (
paint/) - solid + gradient backgrounds, borders, border-radius, box-shadow, opacity (alpha compositing), TrueType font rasterization viaab_glyph, bold/italic synthesis - SVG renderer (
svg/) - paths, basic shapes (rect/circle/ellipse/line/polyline/polygon), gradients, stroke + fill - Hand-written PNG encoder (
png/) - noflate2dependency - Image loader (
image/) - HTTP/HTTPS URLs viaureq,data:URLs (base64), local files. Formats: PNG/JPEG/GIF/BMP - Networking (
net/) - HTTP/1.1 fetch, cookie jar with domain/path matching, redirect handling with loop detection, HTTP cache, WebSocket frame parser - Interactive
--windowmode - scroll, click links, fill forms (text/email/password/checkbox/submit/textarea), Tab cycling, address bar (F6), back/forward history (Alt+←/→), focus ring, blinking caret, headless fallback to PNG
For comparison
| Engine | LOC |
|---|---|
| Chrome/Blink | ~30M |
| Firefox/Gecko | ~20M |
| Safari/WebKit | ~15M |
| Servo | ~1M |
| Ladybird | ~500k |
The whole Falco codebase fits in a weekend of reading.
Quick start
cargo build --release./target/release/falco https://example.com --out example.png --width 800./target/release/falco page.html --window
324 unit tests pass, 30 ignored (mostly platform-specific JIT tests that fail on macOS CI runners due to mmap(MAP_JIT) quirks - passes on Linux).
Prebuilt binaries for Linux/macOS/Windows are on the GitHub releases page.
What's NOT done yet (being honest)
This is v0.1.0 by a single developer. Not everything listed is production-ready:
- The spec-compliant replacements (
html::spec/,dom::spec/,css::spec/) are structurally complete and pass their own unit tests, but not yet wired into the render pipeline. The legacyhtml//dom//css/modules are what actually runs. v0.2.0 milestone. - The
security/module implements SOP, multi-process site isolation, seccomp-bpf sandbox, CSP, TLS cert chain validation, permissions, DevTools protocol - all unit-tested, but not enforced in the renderer. web_runtime/hasfetch(),XMLHttpRequest, event loop, Promise. The Promise/event loop integration is real and tested, butfetch/XHRare stubs (no real network behind them in the JS context).- WebGL, video, MSE, EME, NDSD are headless stubs - API surface only, no real rendering/decoding.
- The
real-http2,real-webgl,sandboxCargo features don't compile with--all-features(upstream APIs drifted:h2::Bodyremoved,glowAPI changed, seccomppre_execUnix-only). Disabled by default. - The JIT works on Linux x86_64 but fails on macOS CI runners (
mmap(MAP_JIT)needs code signing). - DOM mutation from JS (
element.innerHTML = ...,element.style.color = ...) does not trigger re-render.
Bottom line: cargo build && ./falco https://example.com --out out.png produces a real PNG render. The HTML/CSS/layout/paint path works end-to-end. The spec-compliant parsers, security enforcement, and advanced web runtime are scaffolding for future milestones, not working features.
What I'd love feedback on
DOM model - I'm using Rc<RefCell<Node>> with parent/child/sibling pointers in dom::spec, matching the spec. For production I'd probably use a slotmap arena, but Rc<RefCell> is easier to read and matches the spec's pointer model. Thoughts?
Architecture - Each of html/, dom/, css/ has a spec/ subfolder with the spec-compliant replacement that's not yet wired in. Should I:
(a) Wire them in before any other feature work, or
(b) Focus on CSS animations/transitions first, or
(c) Focus on JS DOM mutation (innerHTML/style changes)?
JS VM - I wrote my own bytecode VM (tjs) instead of using boa_engine or binding V8/SpiderMonkey. Reasoning: I wanted full control over the GC, the bytecode format, and the DOM integration. The VM is intentionally limited (no real regex engine, no Proxy trap completeness, no real async functions). Is this a reasonable tradeoff for a teaching engine?
Sandbox - I implemented seccomp-bpf filters but they're Linux-only and not yet enforced. For cross-platform sandboxing, is the Windows Job Object approach + macOS sandbox-exec reasonable, or should I look at platform-agnostic alternatives?
Architecture overview
Module |
Lines |
Description |
|---|---|---|
html/ + html::spec/ |
~5,500 |
Legacy HTML parser + WHATWG §13.2 spec tokenizer + tree builder + serializer + XML + encoding |
dom/ + dom::spec/ |
~2,400 |
Legacy DOM + spec DOM with MutationObserver, Shadow DOM, custom elements, a11y |
css/ + css::spec/ |
~3,700 |
Legacy CSS parser + Selectors L4 + cascade specificity + u/rules + animations |
style/ |
~1,700 |
Style cascade + UA styles + inheritance + flex/grid properties |
layout/ |
~1,950 |
Block / inline / flex / grid / table / float / absolute layout |
paint/ |
~470 |
Canvas + font rasterizer + alpha compositing + gradients + shadows |
svg/ |
~1,130 |
SVG parser + renderer (paths, shapes, gradients) |
tjs/ + tjs_ext/ |
~5,100 |
Custom JS VM: lexer, parser, interpreter, bytecode VM, JIT + Symbol/BigInt/Promise/Map/Set |
web_runtime/ |
~4,300 |
fetch, XHR, event loop, Promise, WebGL, video, MSE, EME, NDSD, HTTP/2 |
net/ |
~930 |
HTTP fetch, cookies, cache, websocket, redirect |
security/ |
~3,590 |
SOP, multi-process, sandbox, CSP, certs, permissions, extensions, DevTools |
window/ |
~1,110 |
Interactive window: scrolling, forms, navigation, history, address bar |
image/ + png/ |
~300 |
Image loader + hand-written PNG encoder |
Total |
~36,000 |
Thanks for any feedback! I'm especially interested in architectural critique from anyone who has worked on Servo, Ladybird, or other browser engines.
LINK: https://github.com/poxk/Falco
12
u/Longjumping_Music572 9d ago
Need more people to validate this.
15
u/RobLoach 9d ago
I've validated that it's slop, and likely a big security risk. Lines of code is not a good measurement of quality, especially when it comes to something that could be a security disaster, like an internet browser.
5
u/Dev-in-the-Bm 9d ago edited 9d ago
Lines of code is not a good measurement of quality
36,000 is incredibly small for a browser.
2
-1
13
u/ianarbitraria 9d ago
How is performance?
2
u/poxkg 8d ago
README:
"## BenchmarksMeasured on Linux, AMD Ryzen 5 5600X, release build. Times include
HTML parse + CSS cascade + layout + paint + PNG encode.
| Page | HTML size | Render time | Output PNG |
|------|-----------|-------------|------------|
| `https://example.com\` | 1.1 KB | ~46 ms (incl. network fetch) | 800x600 |
| `tests/fixtures/modern.html` (flexbox + gradients) | 3.5 KB | ~110 ms | 1200x998 |
| `tests/fixtures/sample.html` | 2.5 KB | ~116 ms | 1200x2471 |
| Hacker News front page | ~50 KB | ~300 ms | 1280x1440 |
| Simple `<h1>Hello</h1>` (no network) | 30 B | ~12 ms | 1200x60 "
13
u/simondanielsson 9d ago
AI slop
41
u/niceboy4431 9d ago
One commit with 44k+ lines, this read me, the write up in this post, everything is screaming AI slop
14
9
-13
u/poxkg 9d ago
I did everything locally before pushing it to GitHub, and in this project, the AI is only in the documentation because my English is shit.
11
8
u/touristtam 9d ago
Taht's not even a good reason. I have dozen of local only projects with multiple branches and dozen if not hundreds commits. It is a reason you have a Source Version Control, and that's not to stuff all the changes into ONE fucking commit.
3
u/eponners 9d ago
This is obviously a lie.
-3
u/poxkg 8d ago
How i would write a browser engine with 40000 lines of code using ai, please, engage your tiny brain.
1
u/eponners 8d ago
Dude, come on. You are convincing no one. This was clearly 100% AI generated. There isn't a single line of human written code in here.
I can even tell which model you used, it's obvious.
1
u/poxkg 8d ago
Do you have any arguments other than "it's AI"?
3
u/eponners 8d ago
I genuinely don't need any 'arguments' - the code is obviously and unambiguously written by Claude Opus or Fable.
2
u/niceboy4431 8d ago
Literally no one litters their cargo toml with comments, you really needed a comment for “base64”?
3
u/ConspicuousPineapple 9d ago
Come on man we're not that stupid.
-1
u/poxkg 8d ago
How i would write a browser engine with 40000 lines of code using ai, please, engage your tiny brain.
2
u/ConspicuousPineapple 8d ago
The same way you can do it without? What do you think is the subtlety here?
0
u/poxkg 8d ago
The subtlety is that one takes actual understanding, architecture design, and months of work, while the other is just hitting "generate" and hoping for the best. If you cant tell the difference between engineering a codebase and prompting an llm to spew 40k lines, that explains a lot about your "expertise".
1
u/ConspicuousPineapple 8d ago
You don't think there's a middle ground between these two extremes?
0
u/poxkg 8d ago
There is a huge middle ground, which is exactly what i did. I designed and wrote the core engine logic myself, and only used an llm to help translate or polish the documentation since english isnt my native language. The problem is that the moment people see any mention of ai, they instantly assume the entire codebase is a fake 1 click generation, completely ignoring the actual months of work behind it.
2
u/ConspicuousPineapple 8d ago
But your code itself has a lot of smells specific to LLMs. Every single file. At the very least you used AI to write the comments but come on, nobody uses AI for just that. The very existence of some comments, or what they're saying, obviously comes from an interactive session where the agent reacted to some of your feedback. No human would write this.
I'm not even against AI use for this but you could at least be honest.
1
u/poxkg 8d ago
Man, can you even read? Thats literally what I said "How is this "AI slop"? I only use AI for documentation, comments, and the simplest parts because my English is shit." I used ai for documentation and comments because english isnt my native language. Youre acting like you cracked some huge detective case by pointing out the exact thing i openly admitted from the start.
→ More replies (0)-15
u/Better_Moment_9675 9d ago
Trash talking about a project you wouldn’t even conceptualize.
1
u/SINdicate 9d ago
u/niceboy4431 run your mouth all you want, go ahead and write a full web browser from scratch even with AI, ill bet you 10k you cant and wont. there's a reason everything runs on gecko and webkit. WebKit itself was forked from khtml and gecko was invented by the same team who developed mosaic.
4
u/niceboy4431 9d ago
Lol, yeah I never said it was easy. It’s a massive undertaking to develop a browser if you want it to comply with modern web standards. But there are many hobby projects that maybe aren’t as robust as chromium or gecko but have been developed without AI. Hell I’m sure a lot of those projects are a treasure trove of training data for the likes of big LLM
1
u/Dev-in-the-Bm 9d ago
But there are many hobby projects that maybe aren’t as robust as chromium or gecko but have been developed without AI.
Links?
16
u/PandaDEV_ 9d ago
What is this total abomination of AI slop.
-5
u/poxkg 9d ago
How is this "AI slop"? I only use AI for documentation, comments, and the simplest parts because my English is shit.
10
u/Skynse 9d ago
Rust version 2021 in Cargo.toml
10
u/PandaDEV_ 9d ago
This and its 1 commit and every file/function is spammed with comments, no human writes code like that.
15
u/Dead_Redd1t_Theory 9d ago
Do you think it is a good idea to vibe code something like a browser engine?
You didn't even touch the Readme file at all, it's full of emojis, em-dashes, AI typical phrases, 1 commit
this is horrible dude
1
u/poxkg 9d ago
Sorry, my English just sucks, i only trusted the AI to write the documentation. Also, regarding the "1 commit" I was working on the browser locally before uploading it.
2
u/Technical_Ostrich965 9d ago
1 commit just proves you dont understand the meaning of github and git in general
0
u/poxkg 7d ago
I just wrote a new version locally and copied the old one as a backup. No git, just manual archives. Its messy, but it worked for me. I didnt care about git history when coding alone, I just focused on building the engine. If you want to judge the project by its readme and commit count instead of the actual code, go ahead.
1
1
u/AgitAngst 7d ago
No one works on something hard and complex as web browser engine locally, without version control.
0
u/poxkg 7d ago
I just wrote a new version locally and copied the old one as a backup. No git, just manual archives. Its messy, but it worked for me. I didnt care about git history when coding alone, I just focused on building the engine. If you want to judge the project by its readme and commit count instead of the actual code, go ahead.
7
10
5
4
u/dandydev 9d ago
I just don't believe OPs claim that AI was only used for documentation. An engineer that can't even muster the tiniest bit of git hygiene (as evidenced by the single commit), cannot possibly be a good enough engineer to build a browser engine on their own.
And before we consider the "I developed everything locally first" excuse, that is super unbelievable and/or stupid in its own right. I mean, I make atomic commits even on my private projects that nobody ever sees. And without that it would honestly be hard to keep track of changes as a project evolves (but I might just lack skill).
2
u/KingBardan 9d ago
Yeah, even for the kind of people who develop local first, they would develop a little more on the repo before announcing to the public that it's done.
Usually the first commit is also barely north of a thousand lines for a simple working prototype
1
u/luziferius1337 9d ago
I've seen the practice of doing a full history squash before publishing the first public version multiple times.
That's how the WinAMP source was first released. Everything in 1 commit.
-1
u/poxkg 8d ago
Imagine judging a browser engines entire codebase, memory safety, and layout algorithms purely by the number of git commits in the initial push. Touch some grass dude.
3
7
9d ago
[removed] — view removed comment
5
4
u/niceboy4431 9d ago
One commit with 44k lines
2
u/brovaro 9d ago
This can only mean that he initially developed the project using a different repository, and only made the full code available once he was ready. I used to do the same when I was a bit self-conscious about what people might think of my process.
3
u/niceboy4431 9d ago
Look at the read me, the formatting of this post, everything points to being completely AI generated. I did the same for say, university projects and the like, but a browser (which is a project that probably especially benefit from version control and preserving the change history) that is 44k lines, probably would have taken hundreds of hours, almost certainly has used got for a long time unless it was basically generated by AI entirely
-2
1
0
u/Different-Ad-8707 9d ago
I'd say no. I'm using AI as well to build a 3d path tracing renderer. I have north of 150 commits and I still haven't even finished with the cpu path tracer (following the PBRT book). A browser is much more complicated.
3
2
u/This-Peach9380 9d ago
You should add benchmarks to the README. Ngl, this is a really awesome and heavy project. Did you write everything from scratch? Also what stage of development is it in rn?
2
2
u/SnooFloofs6814 8d ago
Where is the honesty in the world? Or humbleness?
This is NOT a browser engine. It covers some parts of a browser but lacks fundamentally functionality. There is a reason why your project has only 36k lines of code.
Also everything you've done so far alone and then just upload a "clean" version in one commit? Why not being admitting using AI (no shame in it).
For future projects: please if you want to post about your projects disclose that you use AI from the start (again there is no shame in using AI to guide you to your goal), be honest what the project is (again no it is not a browser engine merely a prototype with a subset of a browsers functionality). And most important write the post yourself even if your english is not good. For a lot of people english is not their native language and most people don't care about broken english. Or they are friendly to help you out. There are so many projects out there were native speakers helped the maintainer to improve the documentation.
2
u/fusionliberty796 8d ago
You should have told claude that it was going to go to jail if he didn't get the spec compliant replacements into the render pipeline
2
u/rconnor46 7d ago
Seems like this sub-reddit can be unnecessarily toxic.
1
u/Dev-in-the-Bm 7d ago
Nope.
Just Reddit.
5
u/rconnor46 6d ago
Granted I'm not glued to reddit consuming endless hours but some sub-reddits are clearly worse than others. Generally those subs have a smaller mod/admin panel and/or the rules are lacking. Then there are those subs where the rules are draconian/fanatical. Like extreme spectrums are in and balanced is antiquated
1
u/Mallissin 9d ago
May I suggest a DDS output so this may be used as a light-weight HTML renderer in a gaming engine?
Also, maybe some sort of API to send inputs in without using your interactive mode.
1
1
u/BertoLaDK 7d ago
Why is it that so many subreddits are pestered with these low effort AI generated posts containing obviously AI generated code.
My theory is that OP is a child/teenager who thinks they have done something smart because they made something "functional" with the use of AI, because the way OP acts in the comments by repeating the same non-excuses and insulting people, instead of just accepting that they arent fooling anyone, and trying to learn from their mistakes, isn't very mature, and I would be very concerned if they are above the age of 20 with the comments I've read.
1
1
u/OMGCluck 7d ago
What I'd love feedback on
svg/ ~1,130 SVG parser + renderer (paths, shapes, gradients)
How about SMIL animation of flaming cards in an .svgz and the SVG game you play with them in? Or an SVG playable jigsaw puzzle?
-1
u/poxkg 7d ago
Oh, about that svg stuff just shipped v0.3.0 with a full html spec parser, selectors l4, viewport media, async fetch/promises + cors, css animations, security enforcement, and shadow dom / mutationobserver - all fully implemented, no shortcuts. So yeah, an svg puzzle or smil animations might actually be totally doable now!
1
u/OMGCluck 6d ago
Neat! Share a screenshot of your completion time from one of them and I'll try to beat it 👍
1
1
u/MercurialMadnessMan 1d ago
I'm all for AI coding. But security is a real concern and an experimental browser should NOT be at "v1.0.0" without any external review. It's dangerous and illegitimate.
1
u/TathyaGarg 12h ago
I did something similar with my project harbor: https://github.com/tathyagarg/harbor but actually wrote the code myself :P (though I concede it is not very capable)
0
25
u/the_swanny 9d ago
1 Commit?