I wonder if he's aware of this NDSS 2015 paper: http://www.internetsociety.org/doc/exploiting-and-protecting-dynamic-code-generation http://www.internetsociety.

I wonder if he's aware of this NDSS 2015 paper: http://www.internetsociety.org/doc/exploiting-and-protecting-dynamic-code-generation http://www.internetsociety.org/doc/exploiting-and-protecting... TL;DR version: the JIT becomes a separate process that maps the code cache as RW, while the browser itself only sees a RX mapping. They also discuss why flipping between RW and RX in the same process is insecure (basically, TOCTTOU attacks from different threads).