The iterator over registered callbacks failed to account for the
possibility that the callback would remove itself from the list. If
this occurred any remaining callbacks would no longer be reachable from
the node. Switch to the slist iterator that is safe for self-removal.
Note that the slist API remains unsafe for removal of subsequent nodes.
Even with the corrected code removal of the next callback registration
(cached in tmp) will result in it being called anyway, with the
remaining unremoved registrations not being called. If the next
callback were removed and re-registered on a different device, the
callbacks would be invoked for the wrong device.
Resolve this by a documentation change describing the conditions under
which a change to callback registration from within a callback are
permitted. Add a similar note regarding the effect of adding a
callback. The current event invocation behavior for callbacks added
within an event is explicitly left unspecified, though in the current
slist implementation newly added callbacks will not be invoked until the
next event.
Closes#10186
Signed-off-by: Peter A. Bigot <pab@pabigot.com>
d75495709d