Calling Nested Functions on GCC Without an Executable Stack
Indirect Calling of Nested Functions on GCC Without Executable Stack
Martin Uecker explores a hack to support nested functions on older GCC versions without requiring an executable stack. By extracting the code address and static chain from the trampoline that GCC generates, and using `__builtin_call_with_static_chain`, the trampoline can be bypassed, allowing the stack to be cleared with `patchelf --clear-execstack`. He also proposes using trampolines as function descriptors, interpreting them at call sites. Implemented in his experimental library noplate.
In some sense we could say that instead of invoking the trampoline, we are _interpreting_ the code of the trampoline at the call site using a super simple interpreter that only can interpret this specific code sequence and that is so simple that it can be inlined.