The difficult bit isn't the core JavaScript support. There are a dozen engines packaged as libraries that can use for that. The difficult bit is supporting all of the hundreds of DOM APIs.
Also the "undefined behaviours" used for fingerprinting and denying access to non-mainstream UAs even if they have JS support. If I remember correctly, YouTube was doing something like that.