Normally a freelist is a tradeoff between memory and speed, but in this case there is essentially no tradeoff. If you look at the fix you will see that we don't

Normally a freelist is a tradeoff between memory and speed, but in this case there is essentially no tradeoff. If you look at the fix you will see that we don't maintain a freelist of memory in any traditional sense. We just retain a freelist of addresses. These addresses are then used as hints for where to allocate future CodeRange objects. If that address is gone, we'll go somewhere else. Because the memory is fully freed and reallocated this also avoids security concerns.