RichTextBox insert text application will crash

• .NET Core Version: netcoreapp 3.1
• Windows version: Windows 10 CMGE
• Does the bug reproduce also in WPF for .NET Framework 4.8?: Yes
• Is this bug related specifically to tooling in Visual Studio (e.g. XAML Designer, Code editing, etc…)? No.
• Security issues and bugs should be reported privately, learn more via our responsible disclosure guidelines.

Problem description: the problem occur when we set the caret on the BlockUIContainer and typing any character,that will raise FatalExecutionEngineError in framework 4.7.2 or raise ExecutionEngineException in netcore 3.1.

How to reproduce?

1. create an wpf project,and add this xaml code to mainwindow.xaml

<RichTextBox>
            <FlowDocument>
                <BlockUIContainer>
                    <Image Source="D:\sample.jpg"/>
                </BlockUIContainer>
            </FlowDocument>
        </RichTextBox>

1. use an image file to instead D:\sample.jpg
2. run app
   4.click image and press Arrow-Right
   5.type any character

[miloush]

Basically I think it is illegal to add a paragraph during SetText since TSF has a lock on the store. Citing the documentation:

Applications must never modify the document or send change notifications using the ITextStoreACPSink::OnTextChange method from within the ITextStoreACP::RequestLock method.

For the first option, if the _netCharCount is updated with the correct value in SetText, the crash is fixed (by definition) and the IME works uninterrupted, but I believe we should technically inform the sink that a paragraph has been added once the lock is lifted. This is a bit tricky because we need to track where the paragraph insertion ends up being after the composition.

[Luoyingliang]

we test in another device,this problem reproduce again