> Heap-allocated trampolines have an obvious deallocation problem; it would be interesting to see what strategy is used for that.
With -ftrampoline-impl=heap, GCC automatically insert[1] pairs of constructor/destructor routines from libgcc which were built around mmap/munmap.
Those routines seem like they are called in a nested fashion, LIFO. Like __gcc_nested_func_ptr_deleted knows that it's destroying the most recently created trampoline.
It probably has some logic for dealing with different threads, and also for dealing with stack frames abandoned by longjmp or a longjmp-like mechanism.