We maintain a list of regions that are ok to execute from. If the application tries to execute from a region not on the list that is writable, we mark it read-only and then add it to the list before copying its code into the code cache.