When the address of a nested function is taken, GCC creates a trampoline at run-time, which is placed on the stack, requiring an executable stack and posing security risks. GCC has an option to place trampolines on the heap, but this still has overhead and potential leaks with longjmp.

GCC 16 guarantees that nested functions not accessing parent function variables will not require trampolines, even without optimization, and warns when attempting to return functions that do access local context.

GCC 17 introduces built-in functions allowing nested functions with capture without trampolines, using existing __builtin_call_with_static_chain and new built-ins. The compiler automatically transforms code to pass data pointers via special registers reserved by the ABI.

Even without proper language support, wide pointer types and macros can wrap built-ins for cleaner syntax. The compiler optimizes this to minimal assembly code.