libc: Fix dtor order in __cxa_thread_atexit

The thread_local variable may creates another thread_local variable
inside its dtor. This new object is immediately be registered in
__cxa_thread_atexit() and need to be freed before processing another
variable.

This fixes the libcxx test thread_local_destruction_order.pass.cpp.

Reported by:    kib
Approved by:    lwhsu (mentor)
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55826

lib/libc/stdlib/cxa_thread_atexit_impl.c

@@ -119,9 +119,9 @@ walk_cb_nocall(struct cxa_thread_dtor *dtor __unused)
 static void
 cxa_thread_walk(void (*cb)(struct cxa_thread_dtor *))
 {
-	struct cxa_thread_dtor *dtor, *tdtor;
+	struct cxa_thread_dtor *dtor;
 
-	LIST_FOREACH_SAFE(dtor, &dtors, entry, tdtor) {
+	while ((dtor = LIST_FIRST(&dtors)) != NULL) {
 		LIST_REMOVE(dtor, entry);
 		cb(dtor);
 		free(dtor);