There's a significant amount of voodoo involved (mostly crazy with() {} statements) in the CS editor that only John Resig fully understands AFAIK, but the rough idea used was to ship the code over to a web worker where all the global APIs it might use were mocked out. This was a relatively short list for KA CS since it's boxed into the processing framework with a few extensions, but would be pretty complicated for full browser environment (probably bordering on impossible). Then we start a timer in the main UI thread, and if the web worker doesn't respond in some amount of time, we kill the web worker and present the error message.