chore: destroyFFIContext refuse static context

Author: gmelodie

ffi/ffi_context_pool.nim

@@ -41,10 +41,18 @@ proc createFFIContext*[T](
     return err("createFFIContext: initContextResources failed: " & $error)
   ok(ctx)
 
+proc isStaticCtx[T](pool: var FFIContextPool[T], ctx: ptr FFIContext[T]): bool =
+  ## `staticCtx` is published before the state flips, so `Ready` implies it is readable.
+  pool.staticState.load() == StaticCtxReady and
+    pool.staticCtx.load() == cast[pointer](ctx)
+
 proc destroyFFIContext*[T](
     pool: var FFIContextPool[T], ctx: ptr FFIContext[T]
 ): Result[void, string] =
   ## On thread-exit timeout the slot is leaked; closing live-thread resources is unsafe.
+  # Destroying it would release the slot while `staticState` still points at it.
+  if pool.isStaticCtx(ctx):
+    return err("destroyFFIContext(pool): the {.ffiStatic.} context outlives every ctx")
   ctx.stopAndJoinThreads().isOkOr:
     return err("destroyFFIContext(pool): " & $error)
   # Required: next acquisition would otherwise re-init a live lock (UB).

tests/unit/test_ffi_context.nim

@@ -163,6 +163,18 @@ suite "FFIContextPool":
     for c in ctxs:
       discard sharedPool.destroyFFIContext(c)
 
+  test "destroyFFIContext refuses the static context but not a plain one":
+    let staticCtx = sharedPool.staticFFIContext().valueOr:
+      assert false, "staticFFIContext failed: " & $error
+      return
+    check sharedPool.destroyFFIContext(staticCtx).isErr()
+    # Still live and still the same context, not a released slot.
+    check sharedPool.staticFFIContext().tryGet() == staticCtx
+    let plain = sharedPool.createFFIContext().valueOr:
+      assert false, "createFFIContext(pool) failed: " & $error
+      return
+    check sharedPool.destroyFFIContext(plain).isOk()
+
   test "a failed create leaves staticFFIContext retryable":
     var ctxs: array[MaxFFIContexts, ptr FFIContext[TestLib]]
     for i in 0 ..< MaxFFIContexts: