Sorry, I don't understand your statement there at all. All I was pointing out is that if the TPM generates an interrupt to the NVIC (additional edges) on a priority-level it is already servicing (from first edge), then the associated Pending bit in PR WILL be set, and that WILL cause ISR reentry when that interrupt level is 'cleared' by the exception-return (actually tail-chained to avoid a true 'return', but I digress). I expect it is valid to hit ICPR to clear a pending-register bit, but presumably ONLY after the 'cause' has been seen as 'no longer true' feeding into the NVIC, and THAT leads to my statement about propagation-delay considerations. That is, as you have it coded above the 'TPM Clear' and the 'NVIC Clear' are back-to-back, and thru the peripheral-bus write-buffering operations the resultant bus cycles could also be back-to-back, giving maybe just one clock for the TPM-register change to start to wander-over into the NVIC. I would recommend either disabling the write-buffer for this pair, or find some other 'write' operations to stick between the pair, to insure 'some clocks' propagation time. And then, too, one would have to 'worry' about any delays internal to the NVIC between said 'PR-clear' write-cycle (again being mindful that write-buffering can place instruction-decode WELL AHEAD of a write-result) and the beginning of the Cortex-core processing of the 'exception return/tail-chaining' (the next step in your code) to make sure that said attempt-to-clear-pending has removed the TPM-bit influence on the 'next instruction' decisions -- these statements, of course, being what I was referring to earlier about 'assuming' the internal interrupt signal path delays.
This behavior is not an 'anomaly' in any way, it is just the way such hardware works, like the 'very sophisticated' NVIC.