[fmap]

Because of the way nested functions are implemented in GCC.

If you call a nested function it has to know the frame address of the containing function in order to refer to its local variables. So if you take the address of such a function the program actually receives the address of a "trampoline": a small sequence of instructions which first loads the frame address and then calls the real function.

The trampoline itself is generated dynamically and putting it on the stack turns out to be cheaper than heap allocating it.

[ori_b]

> and putting it on the stack turns out to be cheaper than heap allocating it.

Well, more so that C has no concept of the heap. That's entirely contained within the C libraries. So, the language implementation itself can't do heap allocations (at least, not without sacrificing any chance of using it in embedded or kernel dev situations where you don't have heap allocation, or where you need to use custom allocators)

[swdunlop]

If you're using closures in an embedded environment with no heap, you've got bigger problems than executable stacks to worry about..