[Darwin] MTRBaseSubscriptionCallback OnDone callback being called async can lead to crashes

[jtung-apple]

Reproduction steps

1. ReadClient starts tearing down, for example during `OnLivenessTimeoutCallback` calling `Close`
2. While that is happening, Darwin framework calls read with a `MTRClusterStateCacheContainer` parameter with one of the `MTRBaseCluster` objects
3. The `MTRBaseCluster` does a dispatch_sync call to the Matter queue
4. ReadClient `Close` proceeds, and calls `OnError` in the MTRBaseSubscriptionCallback object, which calls `ReportError`, which eventually does an `dispatch_async` to call the OnDone handler (this cleans up the cache container\'s pointer to the c++ object), which is scheduled after BaseCluster\'s read.
5. ReadClient then calls MTRBaseSubscriptionCallback\'s OnDone, which deletes itself and returns
6. The BaseCluster then executes the read with the cache container, which still has a pointer to the now defunct c++ cache, leading to a crash

Platform

darwin

Platform Version(s)

No response

Type

Manually tested with SDK

(Optional) If manually tested please explain why this is only manually tested

No existing tests covers this specific, probably timing-related scenario, and Darwin platform crash tracking caught this crash.

Anything else?

The simple fix is to require (and document in header) SubscriptionCallback's OnDone be called inline. This works because the OnDone handler in MTRBaseDevice today only does one job, which is to clear the cache container's pointer to the c++ object.

I will file another issue to fix this in a more consistent way. One option is to change MTRBaseSubscriptionCallback to always call everything inline, and leave the "call client callback on queue" as exercise in MTRBaseDevice / MTRDevice objects.