I wonder if he's aware of this NDSS 2015 paper: http://www.internetsociety.org/doc/exploiting-and-protecting...

TL;DR version: the JIT becomes a separate process that maps the code cache as RW, while the browser itself only sees a RX mapping. They also discuss why flipping between RW and RX in the same process is insecure (basically, TOCTTOU attacks from different threads).