RichTextBox crashes with Chinese IME when replacing multi-line selection (TextStore.OnStartComposition FailFast)

[Jyh2026]

Description

When using a WPF RichTextBox hosted inside a WinForms application through ElementHost, the application may crash when replacing multi-line selected text using a Chinese IME.

The crash occurs frequently when:

Selecting text containing line breaks

Typing Chinese characters using an IME

Replacing the selected text

The application terminates with Environment.FailFast triggered from TextStore.OnStartComposition.

This appears to be related to the WPF Text Services Framework (TSF) integration.

Reproduction Steps

1 Create a WinForms application
2 Host a WPF RichTextBox using ElementHost
3 Insert text containing multiple line breaks
4 Switch to Chinese IME
5 Select text across multiple lines
6 Type Chinese characters to replace the selection
7 Repeat several times

Result: Application crashes.

Expected behavior

Selected text should be replaced normally by IME input.

Actual behavior

The application requested process termination through System.Environment.FailFast(string message)
Message: 不可恢复的系统错误

Application: testWpfCrash.exe
Framework Version: v4.0.30319
Description: The application requested process termination through System.Environment.FailFast(string message).

Stack:
at System.Environment.FailFast(System.String)
at MS.Internal.Invariant.FailFast(System.String, System.String)
at System.Windows.Documents.TextStore.OnStartComposition(ITfCompositionView, Boolean ByRef)
at MS.Win32.UnsafeNativeMethods+ITextStoreACPSink.OnLockGranted(LockFlags)
at System.Windows.Documents.TextStore.GrantLock()
at System.Windows.Documents.TextStore.GrantLockWorker(LockFlags)
at System.Windows.Documents.TextStore.RequestLock(LockFlags, Int32 ByRef)
at System.Windows.Forms.UnsafeNativeMethods.GetMessageW(MSG ByRef, HandleRef, Int32, Int32)
at System.Windows.Forms.Application.ComponentManager.IMsoComponentManager.FPushMessageLoop
at System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner
at System.Windows.Forms.Application.ThreadContext.RunMessageLoop
at System.Windows.Forms.Application.Run(Form)
at testWpfCrash.Program.Main()

Regression?

No response

Known Workarounds

No response

Impact

No response

Configuration

Environment：
.NET Framework: 4.8.1
OS: Windows 11 Pro 25H2
IDE: Visual Studio 2022
Architecture: x64
Hosting: WinForms + ElementHost + WPF RichTextBox

Other information

thanks
testWpfCrash.zip

[Jyh2026]

using System;
using System.Windows.Forms;
using System.Windows.Forms.Integration;
using System.Windows.Controls;
using System.Windows.Documents;

namespace testWpfCrash
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
InitWpfRichTextBox();
}

    private void InitWpfRichTextBox()
    {
        ElementHost host = new ElementHost
        {
            Dock = DockStyle.Fill
        };
        this.Controls.Add(host);

        var wpfRtb = new RichTextBox
        {
            AcceptsReturn = true,
            AcceptsTab = true,
            VerticalScrollBarVisibility = ScrollBarVisibility.Auto
        };

        wpfRtb.Document.Blocks.Clear();

        wpfRtb.Document.Blocks.Add(
            new Paragraph(
                new Run(
                    "策略应用于单个设备，请执行以下步骤：\r\n\r\n将以下 KIR 策略定义 MSI (.msi) 文件下载到设备上的文件夹..."
                )
            )
        );

        host.Child = wpfRtb;
    }
}

}

[laxmikanth-msft]

@Jyh2026 can you confirm if you see this issue in .NET core?

[Jyh2026]

Thank you for the response. I have tried using WPF within a WinForms form in the .NET 8.0 environment, and there is still an issue where, under Chinese IME, when selecting multiple lines, the program crashes after several attempts.

Attached are the screenshot and the project.

testwpfcrash_net8.zip