> ran the javascript engine in a single-threaded subprocess with a greatly restricted set of allowed system calls.

You were trying to sandbox the JS engine rather than using disposable VMs?