diff --git a/src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs b/src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs
index 514e055929460e..505c9b6d742538 100644
--- a/src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs
+++ b/src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs
@@ -2154,14 +2154,14 @@ private uint getClassAttribsInternal(TypeDesc type)
         private void* LongLifetimeMalloc(UIntPtr sz)
 #pragma warning restore CA1822 // Mark members as static
         {
-            return (void*)Marshal.AllocCoTaskMem((int)sz);
+            return NativeMemory.Alloc(sz);
         }
 
 #pragma warning disable CA1822 // Mark members as static
         private void LongLifetimeFree(void* obj)
 #pragma warning restore CA1822 // Mark members as static
         {
-            Marshal.FreeCoTaskMem((IntPtr)obj);
+            NativeMemory.Free(obj);
         }
 
         private UIntPtr getClassStaticDynamicInfo(CORINFO_CLASS_STRUCT_* cls)
@@ -3211,8 +3211,8 @@ private void getVars(CORINFO_METHOD_STRUCT_* ftn, ref uint cVars, ILVarInfo** va
         private void reportRichMappings(InlineTreeNode* inlineTree, uint numInlineTree, RichOffsetMapping* mappings, uint numMappings)
 #pragma warning restore CA1822 // Mark members as static
         {
-            Marshal.FreeHGlobal((IntPtr)inlineTree);
-            Marshal.FreeHGlobal((IntPtr)mappings);
+            NativeMemory.Free(inlineTree);
+            NativeMemory.Free(mappings);
         }
 
 #pragma warning disable CA1822 // Mark members as static
@@ -3225,14 +3225,14 @@ private void reportMetadata(byte* key, void* value, nuint length)
         private void* allocateArray(UIntPtr cBytes)
 #pragma warning restore CA1822 // Mark members as static
         {
-            return (void*)Marshal.AllocHGlobal((IntPtr)(void*)cBytes);
+            return NativeMemory.Alloc(cBytes);
         }
 
 #pragma warning disable CA1822 // Mark members as static
         private void freeArray(void* array)
 #pragma warning restore CA1822 // Mark members as static
         {
-            Marshal.FreeHGlobal((IntPtr)array);
+            NativeMemory.Free(array);
         }
 
 #pragma warning disable CA1822 // Mark members as static
diff --git a/src/coreclr/tools/Common/JitInterface/CorInfoImpl_generated.cs b/src/coreclr/tools/Common/JitInterface/CorInfoImpl_generated.cs
index 8d0c83046277dd..e1065b2706224b 100644
--- a/src/coreclr/tools/Common/JitInterface/CorInfoImpl_generated.cs
+++ b/src/coreclr/tools/Common/JitInterface/CorInfoImpl_generated.cs
@@ -2606,7 +2606,7 @@ private static uint _getJitFlags(IntPtr thisHandle, IntPtr* ppException, CORJIT_
 
         private static IntPtr GetUnmanagedCallbacks()
         {
-            void** callbacks = (void**)Marshal.AllocCoTaskMem(sizeof(IntPtr) * 176);
+            void** callbacks = (void**)NativeMemory.Alloc((nuint)(sizeof(void*) * 176));
 
             callbacks[0] = (delegate* unmanaged<IntPtr, IntPtr*, CORINFO_METHOD_STRUCT_*, byte>)&_isIntrinsic;
             callbacks[1] = (delegate* unmanaged<IntPtr, IntPtr*, CORINFO_METHOD_STRUCT_*, byte>)&_notifyMethodInfoUsage;
diff --git a/src/coreclr/tools/Common/JitInterface/JitConfigProvider.cs b/src/coreclr/tools/Common/JitInterface/JitConfigProvider.cs
index 459e20a8b94b81..5960572a816cea 100644
--- a/src/coreclr/tools/Common/JitInterface/JitConfigProvider.cs
+++ b/src/coreclr/tools/Common/JitInterface/JitConfigProvider.cs
@@ -164,12 +164,12 @@ private static unsafe IntPtr CreateUnmanagedInstance()
 
             const int numCallbacks = 2;
 
-            void** callbacks = (void**)Marshal.AllocCoTaskMem(sizeof(IntPtr) * numCallbacks);
+            void** callbacks = (void**)NativeMemory.Alloc((nuint)(sizeof(void*) * numCallbacks));
 
             callbacks[0] = (delegate* unmanaged<IntPtr, byte*, int, int>)&getIntConfigValue;
             callbacks[1] = (delegate* unmanaged<IntPtr, byte*, byte*, int, int>)&getStringConfigValue;
 
-            IntPtr instance = Marshal.AllocCoTaskMem(sizeof(IntPtr));
+            IntPtr instance = (IntPtr)NativeMemory.Alloc((nuint)sizeof(IntPtr));
             *(IntPtr*)instance = (IntPtr)callbacks;
 
             return instance;
diff --git a/src/coreclr/tools/Common/JitInterface/ThunkGenerator/Program.cs b/src/coreclr/tools/Common/JitInterface/ThunkGenerator/Program.cs
index 1f0362ea7e9e9a..172c2839f014ed 100644
--- a/src/coreclr/tools/Common/JitInterface/ThunkGenerator/Program.cs
+++ b/src/coreclr/tools/Common/JitInterface/ThunkGenerator/Program.cs
@@ -349,7 +349,7 @@ internal unsafe partial class CorInfoImpl
             tw.WriteLine(@"
         private static IntPtr GetUnmanagedCallbacks()
         {
-            void** callbacks = (void**)Marshal.AllocCoTaskMem(sizeof(IntPtr) * " + total + @");
+            void** callbacks = (void**)NativeMemory.Alloc((nuint)(sizeof(void*) * " + total + @"));
 ");
 
             int index = 0;
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSFunctionBinding.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSFunctionBinding.cs
index b7e4adf82ce3d0..9375b83b013401 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSFunctionBinding.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSFunctionBinding.cs
@@ -417,7 +417,7 @@ internal static unsafe void DispatchJSImportAsyncPost(JSFunctionBinding signatur
             exc.slot.ReceiverShouldFree = true;
 
             var bytes = sizeof(JSMarshalerArgument) * arguments.Length;
-            void* cpy = (void*)Marshal.AllocHGlobal(bytes);
+            void* cpy = NativeMemory.Alloc((nuint)bytes);
             arguments.CopyTo(new Span<JSMarshalerArgument>(cpy, arguments.Length));
             var sig = (nint)signature.Header;
 
@@ -440,7 +440,7 @@ internal static unsafe JSFunctionBinding BindJSImportImpl(string functionName, s
             if (exceptionPtr != IntPtr.Zero)
             {
                 var message = Marshal.PtrToStringUni(exceptionPtr)!;
-                Marshal.FreeHGlobal(exceptionPtr);
+                NativeMemory.Free((void*)exceptionPtr);
                 throw new JSException(message);
             }
 
@@ -480,7 +480,7 @@ internal static unsafe void ResolveOrRejectPromise(JSProxyContext targetContext,
 
                 // this copy is freed in SystemInteropJS_ResolveOrRejectPromise
                 var bytes = sizeof(JSMarshalerArgument) * arguments.Length;
-                void* cpy = (void*)Marshal.AllocHGlobal(bytes);
+                void* cpy = NativeMemory.Alloc((nuint)bytes);
                 arguments.CopyTo(new Span<JSMarshalerArgument>(cpy, arguments.Length));
 
                 // async
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.Types.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.Types.cs
index d65421592248a2..c4052d95d979ed 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.Types.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.Types.cs
@@ -26,7 +26,7 @@ public PromiseHolder(JSProxyContext targetContext)
                 GCHandle = (IntPtr)InteropServices.GCHandle.Alloc(this, GCHandleType.Normal);
                 ProxyContext = targetContext;
 #if FEATURE_WASM_MANAGED_THREADS
-                State = (PromiseHolderState*)Marshal.AllocHGlobal(sizeof(PromiseHolderState));
+                State = (PromiseHolderState*)NativeMemory.Alloc((nuint)sizeof(PromiseHolderState));
                 Interlocked.Exchange(ref (*State).IsResolving, 0);
 #endif
             }
@@ -36,7 +36,7 @@ public PromiseHolder(JSProxyContext targetContext, nint gcvHandle)
                 GCHandle = gcvHandle;
                 ProxyContext = targetContext;
 #if FEATURE_WASM_MANAGED_THREADS
-                State = (PromiseHolderState*)Marshal.AllocHGlobal(sizeof(PromiseHolderState));
+                State = (PromiseHolderState*)NativeMemory.Alloc((nuint)sizeof(PromiseHolderState));
                 Interlocked.Exchange(ref (*State).IsResolving, 0);
 #endif
             }
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.cs
index a75c897458d04c..26a133fbbc6021 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.cs
@@ -131,7 +131,7 @@ public static unsafe JSFunctionBinding GetMethodSignature(ReadOnlySpan<JSMarshal
             }
 
             // this is never unallocated
-            IntPtr buffer = Marshal.AllocHGlobal(size);
+            IntPtr buffer = (IntPtr)NativeMemory.Alloc((nuint)size);
 
             var signature = new JSFunctionBinding
             {
@@ -185,7 +185,7 @@ public static unsafe JSFunctionBinding GetMethodSignature(ReadOnlySpan<JSMarshal
 
         public static unsafe void FreeMethodSignatureBuffer(JSFunctionBinding signature)
         {
-            Marshal.FreeHGlobal((nint)signature.Header);
+            NativeMemory.Free(signature.Header);
             signature.Header = null;
             signature.Sigs = null;
         }
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSProxyContext.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSProxyContext.cs
index 0b32ea89bfb753..cd1509ba8309a9 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSProxyContext.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSProxyContext.cs
@@ -398,7 +398,7 @@ public void ReleasePromiseHolder(nint holderGCHandle)
 #if FEATURE_WASM_MANAGED_THREADS
                 unsafe
                 {
-                    Marshal.FreeHGlobal((IntPtr)holder.State);
+                    NativeMemory.Free(holder.State);
                     holder.State = null;
                 }
 #endif
@@ -442,7 +442,7 @@ public unsafe void ReleaseJSOwnedObjectByGCHandle(nint gcHandle)
                     holderCallback = holder.Callback;
                     holder.IsDisposed = true;
 #if FEATURE_WASM_MANAGED_THREADS
-                    Marshal.FreeHGlobal((IntPtr)holder.State);
+                    NativeMemory.Free(holder.State);
                     holder.State = null;
 #endif
                 }
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Byte.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Byte.cs
index d335d586031d11..991407892bab08 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Byte.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Byte.cs
@@ -83,7 +83,7 @@ public void ToJS(byte? value)
         /// It's used by JSImport code generator and should not be used by developers in source code.
         /// </summary>
         /// <param name="value">The value to be marshaled.</param>
-        public void ToManaged(out byte[]? value)
+        public unsafe void ToManaged(out byte[]? value)
         {
             if (slot.Type == MarshalerType.None)
             {
@@ -92,7 +92,7 @@ public void ToManaged(out byte[]? value)
             }
             value = new byte[slot.Length];
             Marshal.Copy(slot.IntPtrValue, value, 0, slot.Length);
-            Marshal.FreeHGlobal(slot.IntPtrValue);
+            NativeMemory.Free((void*)slot.IntPtrValue);
         }
 
         /// <summary>
@@ -100,7 +100,7 @@ public void ToManaged(out byte[]? value)
         /// It's used by JSImport code generator and should not be used by developers in source code.
         /// </summary>
         /// <param name="value">The value to be marshaled.</param>
-        public void ToJS(byte[]? value)
+        public unsafe void ToJS(byte[]? value)
         {
             if (value == null)
             {
@@ -109,7 +109,7 @@ public void ToJS(byte[]? value)
             }
             slot.Length = value.Length;
             slot.Type = MarshalerType.Array;
-            slot.IntPtrValue = Marshal.AllocHGlobal(value.Length * sizeof(byte));
+            slot.IntPtrValue = (IntPtr)NativeMemory.Alloc((nuint)(value.Length * sizeof(byte)));
             slot.ElementType = MarshalerType.Byte;
             Marshal.Copy(value, 0, slot.IntPtrValue, slot.Length);
         }
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Double.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Double.cs
index b82c5f8fa842a5..b62f5f782e6be2 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Double.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Double.cs
@@ -86,7 +86,7 @@ public void ToJS(double? value)
 #if !DEBUG
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
 #endif
-        public void ToManaged(out double[]? value)
+        public unsafe void ToManaged(out double[]? value)
         {
             if (slot.Type == MarshalerType.None)
             {
@@ -95,7 +95,7 @@ public void ToManaged(out double[]? value)
             }
             value = new double[slot.Length];
             Marshal.Copy(slot.IntPtrValue, value, 0, slot.Length);
-            Marshal.FreeHGlobal(slot.IntPtrValue);
+            NativeMemory.Free((void*)slot.IntPtrValue);
         }
 
         /// <summary>
@@ -106,7 +106,7 @@ public void ToManaged(out double[]? value)
 #if !DEBUG
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
 #endif
-        public void ToJS(double[] value)
+        public unsafe void ToJS(double[] value)
         {
             if (value == null)
             {
@@ -114,7 +114,7 @@ public void ToJS(double[] value)
                 return;
             }
             slot.Type = MarshalerType.Array;
-            slot.IntPtrValue = Marshal.AllocHGlobal(value.Length * sizeof(double));
+            slot.IntPtrValue = (IntPtr)NativeMemory.Alloc((nuint)(value.Length * sizeof(double)));
             slot.Length = value.Length;
             slot.ElementType = MarshalerType.Double;
             Marshal.Copy(value, 0, slot.IntPtrValue, slot.Length);
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Int32.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Int32.cs
index 1798761eeac161..e1db8fa382bd5b 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Int32.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Int32.cs
@@ -83,7 +83,7 @@ public void ToJS(int? value)
         /// It's used by JSImport code generator and should not be used by developers in source code.
         /// </summary>
         /// <param name="value">The value to be marshaled.</param>
-        public void ToManaged(out int[]? value)
+        public unsafe void ToManaged(out int[]? value)
         {
             if (slot.Type == MarshalerType.None)
             {
@@ -92,7 +92,7 @@ public void ToManaged(out int[]? value)
             }
             value = new int[slot.Length];
             Marshal.Copy(slot.IntPtrValue, value, 0, slot.Length);
-            Marshal.FreeHGlobal(slot.IntPtrValue);
+            NativeMemory.Free((void*)slot.IntPtrValue);
         }
 
         /// <summary>
@@ -100,7 +100,7 @@ public void ToManaged(out int[]? value)
         /// It's used by JSImport code generator and should not be used by developers in source code.
         /// </summary>
         /// <param name="value">The value to be marshaled.</param>
-        public void ToJS(int[]? value)
+        public unsafe void ToJS(int[]? value)
         {
             if (value == null)
             {
@@ -108,7 +108,7 @@ public void ToJS(int[]? value)
                 return;
             }
             slot.Type = MarshalerType.Array;
-            slot.IntPtrValue = Marshal.AllocHGlobal(value.Length * sizeof(int));
+            slot.IntPtrValue = (IntPtr)NativeMemory.Alloc((nuint)(value.Length * sizeof(int)));
             slot.Length = value.Length;
             slot.ElementType = MarshalerType.Int32;
             Marshal.Copy(value, 0, slot.IntPtrValue, slot.Length);
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.JSObject.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.JSObject.cs
index 6bf6b9f7edcf13..0743b88b901136 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.JSObject.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.JSObject.cs
@@ -88,7 +88,7 @@ public unsafe void ToManaged(out JSObject?[]? value)
                 arg.ToManaged(out val);
                 value[i] = val;
             }
-            Marshal.FreeHGlobal(slot.IntPtrValue);
+            NativeMemory.Free((void*)slot.IntPtrValue);
         }
 
         /// <summary>
@@ -110,7 +110,7 @@ public unsafe void ToJS(JSObject?[] value)
             int bytes = value.Length * sizeof(JSMarshalerArgument);
             slot.Type = MarshalerType.Array;
             slot.ElementType = MarshalerType.JSObject;
-            JSMarshalerArgument* payload = (JSMarshalerArgument*)Marshal.AllocHGlobal(bytes);
+            JSMarshalerArgument* payload = (JSMarshalerArgument*)NativeMemory.Alloc((nuint)bytes);
             Unsafe.InitBlock(payload, 0, (uint)bytes);
             for (int i = 0; i < slot.Length; i++)
             {
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Object.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Object.cs
index d4506a53ac7113..31223d01d8a5f3 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Object.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.Object.cs
@@ -354,7 +354,7 @@ public unsafe void ToManaged(out object?[]? value)
 #if !ENABLE_JS_INTEROP_BY_VALUE
             Interop.Runtime.DeregisterGCRoot(slot.IntPtrValue);
 #endif
-            Marshal.FreeHGlobal(slot.IntPtrValue);
+            NativeMemory.Free((void*)slot.IntPtrValue);
         }
 
         /// <summary>
@@ -375,7 +375,7 @@ public unsafe void ToJS(object?[] value)
             slot.Length = value.Length;
             int bytes = value.Length * sizeof(JSMarshalerArgument);
             slot.Type = MarshalerType.Array;
-            JSMarshalerArgument* payload = (JSMarshalerArgument*)Marshal.AllocHGlobal(bytes);
+            JSMarshalerArgument* payload = (JSMarshalerArgument*)NativeMemory.Alloc((nuint)bytes);
             Unsafe.InitBlock(payload, 0, (uint)bytes);
 #if !ENABLE_JS_INTEROP_BY_VALUE
             Interop.Runtime.RegisterGCRoot(payload, bytes, IntPtr.Zero);
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.String.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.String.cs
index d0e2d9cb7f9f71..06d476ccdca5c0 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.String.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/Marshaling/JSMarshalerArgument.String.cs
@@ -24,7 +24,7 @@ public unsafe void ToManaged(out string? value)
             }
 #if ENABLE_JS_INTEROP_BY_VALUE
             value = Marshal.PtrToStringUni(slot.IntPtrValue, slot.Length);
-            Marshal.FreeHGlobal(slot.IntPtrValue);
+            NativeMemory.Free((void*)slot.IntPtrValue);
 #else
             fixed (void* argAsRoot = &slot.IntPtrValue)
             {
@@ -96,7 +96,7 @@ public unsafe void ToManaged(out string?[]? value)
 #if !ENABLE_JS_INTEROP_BY_VALUE
             Interop.Runtime.DeregisterGCRoot(slot.IntPtrValue);
 #endif
-            Marshal.FreeHGlobal(slot.IntPtrValue);
+            NativeMemory.Free((void*)slot.IntPtrValue);
         }
 
         /// <summary>
@@ -117,7 +117,7 @@ public unsafe void ToJS(string?[] value)
             slot.Length = value.Length;
             int bytes = value.Length * sizeof(JSMarshalerArgument);
             slot.Type = MarshalerType.Array;
-            JSMarshalerArgument* payload = (JSMarshalerArgument*)Marshal.AllocHGlobal(bytes);
+            JSMarshalerArgument* payload = (JSMarshalerArgument*)NativeMemory.Alloc((nuint)bytes);
             Unsafe.InitBlock(payload, 0, (uint)bytes);
 #if !ENABLE_JS_INTEROP_BY_VALUE
             Interop.Runtime.RegisterGCRoot(payload, bytes, IntPtr.Zero);