I was curious how they implemented the side-effect checking, so I dug my way from the dev tools frontend eventually into v8, where it turns out to basically be a bunch of whitelist checks over bytecode and builtin javascript methods https://github.com/v8/v8/blob/e48d9788a4ef21d3bfffbc691bb02c...