It seems that the way iOS implements W^X protection would prevent a performant JS JIT from being created. It will be interesting to see if/how this is worked around.
The implementation of that is not actually very difficult to do yourself (though I wouldn’t recommend it). The problem is you can’t actually flip the mask to execute unless you have permission to JIT which Apple currently doesn’t provide to third party apps.
Basically every JIT javascript engine now use W^X protection by default. So it is probably a non-issue. I think the problem is 'does apple even allow you to toggle the w and x bit?'.
