Popular packages

Spec conformance doesn't guarantee real libraries work. JS engines that pass 99 % of test262 still routinely break on production code because libraries depend on a long tail of "spec corners" — Proxy traps in specific orders, Function.prototype.toString shape, regex behavior on tricky inputs, the exact way Object.keys ordering interacts with computed property names.

Phasis verifies 204 widely-used libraries byte-for-byte against Node.js (V8). They live under tests/Popular/ in the repo, and CI runs them whenever the engine source or the suite changes.

Coverage by category

Total: 204 libraries all reproduce Node's exact output. All pinned to the latest upstream release as of the last bump.

How it works

Each scenario is a tests/Popular/<lib>/ directory with three files:

tests/Popular/lodash/
├── lodash.js     ← vendored upstream library (untouched, UMD bundle)
├── runner.js     ← Phasis-side script that exercises the library
└── oracle.txt    ← Node.js output of running runner.js (committed)

tests/Popular/PopularPackagesTest.php is a PHPUnit data-provider test that:

1. Loads lodash.js + runner.js into a fresh new Phasis\Engine().
2. Captures console.log output into a buffer.
3. Asserts the captured buffer is byte-equal to oracle.txt.

Regenerate an oracle with:

node tests/Popular/gen-oracle.js tests/Popular/<lib>

(Used when you bump the vendored library — re-runs the runner under real Node and overwrites oracle.txt.)

CI gate

Workflow: .github/workflows/popular.yml.

Runs on pushes and pull requests to main that change src/, tests/Popular/, phpunit.xml.dist, the Composer files or the workflow itself, and on manual dispatch. Two steps:

1. Phasis side — runs the PHPUnit popular testsuite, which executes each library through Phasis and diffs against the committed oracle. Fails if a single byte differs.
2. Node re-verify — runs node tests/Popular/gen-oracle.js … against each library and asserts the freshly regenerated oracle matches what's checked in. Detects "vendored library was bumped without updating the oracle" drift.

Both must pass before the PR merges. A test262 win that breaks lodash isn't acceptable; a lodash win that breaks test262 isn't either.

Why these libraries

• acorn — parsing is the most fragile surface in any JS engine. It exercises every syntactic corner case modern JS adds. If Phasis can parse arbitrary modern code with acorn, the runtime is sound.
• mustache.js — templating is one of the embedding use cases Phasis explicitly targets (the README's first concrete example is "templating engines"). Mustache exercises iteration, scope resolution, and string transforms in the order real templates do.
• lodash — the most-used JS utility library on the planet. Its 300+ functions transitively touch every standard-library method. If lodash works, generic data-transformation JS works.
• marked — markdown rendering. Practical and exercises regex (lots of it) plus string manipulation with cross-line state. Surfaces regex-engine drift between PCRE2 (Phasis' fallback) and V8's Irregexp.
• dayjs — Date/time arithmetic is a classic source of off-by-one bugs that no test262 case catches. dayjs hits constructor variants, arithmetic across DST-equivalent month boundaries, and format-token expansion in roughly the same code paths every JS Date library uses.
• bignumber.js — arbitrary-precision arithmetic without TypedArrays exercises string-based number parsing, large-integer multiply / divide loops, and rounding-mode dispatch — all in pure JS so the engine carries the entire cost. Surfaces any subtle break in Number ↔ String conversion.
• json5 — relaxed JSON parsing leans heavily on character-class regexes and stateful tokenization. A good canary for both regex correctness and string-iteration edges.
• fuse.js — a Babel-transpiled UMD that exercises _classCallCheck (the this instanceof Ctor pattern that every pre-ES6 transpiled class uses) plus the full bitap fuzzy-match algorithm. The kind of shape every Babel-transpiled library shares, so anything that breaks Fuse breaks half the npm ecosystem.
• handlebars — full-featured templating with compile-then-render. Exercises the eval-free runtime path through a single huge compile() entry, AST traversal, helper dispatch through a dynamic lookup table, and SafeString brand-checking that uses instanceof across realms. A counterpoint to mustache.js's simpler template walker.
• zod — runtime schema validation. Heavy class hierarchies (ZodString, ZodObject, ZodArray, ZodUnion, …) with method chaining that returns refined sub-classes, structured error formatting where the JS-side .issues array shape has to match Node byte-for-byte, and discriminator/literal-tag patterns. Tests the kind of OO-heavy validation code that wraps half of modern TypeScript apps.
• typescript — the actual TypeScript compiler running on the embedded engine. 9 MB of minified compiler that re-parses arbitrary TS, walks the AST, and emits JS — the heaviest pure-JS payload imaginable. If Phasis can transpile generics, async/await, enums, and class hierarchies byte-for-byte equal to tsc, the language semantics are sound.
• prettier — opinionated JS formatter. Formatting JS with JS means every spec corner the engine has gets touched by the same control flow that formats your code — a uniquely demanding workload.
• svelte/compiler — Svelte's standalone compiler. Parses .svelte source, walks the AST, emits JS for both client and SSR targets.
• terser / @babel/parser / postcss — JS minifier, JS parser, CSS post-processor. Tens of thousands of lines of minified code that re-parse arbitrary input — the surface where rare AST shapes show up.
• ajv — JSON Schema validator that JIT-compiles each schema to a custom validator function via new Function(...). Exercises the Function-constructor path that most schema/templating libraries lean on.
• mobx — proxy-based reactive state. Every read of an observable runs through a Proxy get trap that registers a dependency; every write fires reactions. A stress test for the Proxy infrastructure, observable Maps / arrays / nested objects, and the autorun scheduler.
• cheerio / htmlparser2 — server-side jQuery on top of a fast HTML parser. Selector-engine parsing, DOM-style traversal, attribute manipulation, and HTML serialization in one package.
• graphql-js / jsonata — GraphQL reference implementation and a JSON query language. Both are heavy on schemas, validation, and recursive evaluators — typical "data layer in the browser" code.
• JSZip — async ZIP archive builder. Routes work through setImmediate-driven scheduling and produces real binary output, exercising both the timer surface and Uint8Array-heavy paths.
• moment / luxon — date/time arithmetic. moment's a mutable, hand-tuned UMD; luxon is the modern immutable rewrite. Together they cover the full surface of formatting, parsing, and timezone-equivalent month/year math.
• mqtt-packet — pure-JS MQTT 3.1.1 / 5.0 codec. Byte-level packing and decoding plus the kind of base64-non-alphabet regex character classes that exercise Annex-B grammar edges.
• xstate / valtio / nanostores / jotai / redux-saga — the modern state-management spread. State machines, proxy state, atom stores, derived atoms, generator-based effect runners — each library hits a different shape of reactivity.
• escodegen / acorn-walk / estraverse / magic-string — AST tooling. Code generation, traversal, and non-destructive source editing — the building blocks for any JS-on-JS transformer (build tools, codemods, linters).
• papaparse / lunr / yaml / sax / css-tree — pure parsers and tokenizers. CSV, full-text search index, YAML 1.2, streaming SAX-style XML, and CSS AST. Different grammars, all good canaries for character-level scanning and regex behavior.

Adding more

Drop a new directory under tests/Popular/<name>/ with the three-file shape, then:

node tests/Popular/gen-oracle.js tests/Popular/<name>   # one-time, generates oracle.txt
git add tests/Popular/<name>

The PHPUnit suite auto-discovers it on the next run, and CI picks it up because the change touches tests/Popular/.

Strong candidates worth adding: chevrotain (parser combinator, exercises closures + regex), nanoid (crypto/randomness boundary), date-fns (timezone surface beyond dayjs).