ShapeSecurity's JavaScript VM: Part 3

This is Part 3 of my series of reversing ShapeSecurity's VM. I have a few more to go. This will only talk about the VM and not the signals and if you need to catch up ready part 1 and 2 that are posted on my blog.