From b7519108d79dee4b6b0498d5579dc88b6dd290d6 Mon Sep 17 00:00:00 2001
From: Abhijeet Jha <74712637+iamAbhi-916@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:07:19 +0530
Subject: [PATCH 1/2] CoreShutdownTests: add regression test for focused
 TextBox at core shutdown

Covers the access violation in CInputServices::GetPrimaryRegisteredIslandInputSite
when a focused TextBox is still alive as CCoreServices::~CCoreServices deletes the
text core. Fixed in main by 691c6a72c95a0f40a3b331d7af9b61e1be58afd6.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../lifetime/tests/CoreShutdownTests.cpp      | 50 ++++++++++++++++++-
 .../lifetime/tests/CoreShutdownTests.h        |  6 +++
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.cpp b/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.cpp
index d41a103c3d..4abe0cfbb1 100644
--- a/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.cpp
+++ b/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.cpp
@@ -1,4 +1,4 @@
-// Copyright (c) Microsoft Corporation. All rights reserved.
+// Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
 #include "pch.h"
@@ -109,4 +109,52 @@ void CoreShutdownTests::RoutedEventArgsCleanup()
     preservedArgs = nullptr;
 }
 
+// Regression test for the shutdown access violation in CInputServices::GetPrimaryRegisteredIslandInputSite.
+//
+// A TextBox that still has focus when the core is torn down is kept alive by the text core rather than
+// by the visual tree, so it outlives ResetCoreWindowVisualTree and is destroyed by CCoreServices::~CCoreServices
+// at "delete m_pTextCore". That teardown synchronously re-enters input:
+//   CTextBoxBase::Destroy -> OnTxInPlaceDeactivate -> ShowGrippers -> TxGetWindow
+//     -> CDependencyObject::GetElementIslandInputSite -> CInputServices::GetPrimaryRegisteredIslandInputSite
+// m_inputServices is an xref_ptr, so resetting it before the text core is deleted destroys CInputServices
+// and that callback then runs on a null instance, faulting while reading m_islandInputSiteRegistrations.
+//
+// The test deliberately leaves the focused TextBox in the tree across shutdown. It fails as an access
+// violation (0xC0000005) if the reset is ordered before the text core teardown.
+void CoreShutdownTests::FocusedTextBoxAtCoreShutdown()
+{
+    TestServices::WindowHelper->InitializeXaml();
+
+    auto shutdownGuard = wil::scope_exit([]
+    {
+        TestServices::WindowHelper->ShutdownXaml();
+    });
+
+    xaml_controls::TextBox^ textBox = nullptr;
+
+    RunOnUIThread([&]
+    {
+        textBox = ref new xaml_controls::TextBox();
+        textBox->Text = L"focused text input at shutdown";
+        TestServices::WindowHelper->WindowContent = textBox;
+    });
+    TestServices::WindowHelper->WaitForIdle();
+
+    // Focus activates the RichEdit host in place, which is what arms the deactivation callback below.
+    RunOnUIThread([&]
+    {
+        VERIFY_IS_TRUE(textBox->Focus(xaml::FocusState::Programmatic));
+    });
+    TestServices::WindowHelper->WaitForIdle();
+
+    // Release the test's reference but deliberately leave the TextBox focused and in the tree, so the
+    // text core owns the final reference and drops it during core destruction.
+    RunOnUIThread([&]
+    {
+        textBox = nullptr;
+    });
+
+    shutdownGuard.reset();
+}
+
 } } } } } }
diff --git a/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.h b/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.h
index 967f7b43c7..e93eeed3c7 100644
--- a/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.h
+++ b/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.h
@@ -31,5 +31,11 @@ namespace Microsoft { namespace UI { namespace Xaml { namespace Tests {
             TEST_METHOD_PROPERTY(L"TestPass:IncludeOnlyOn", L"Desktop")
             TEST_METHOD_PROPERTY(L"Hosting:Mode", L"UAP")
         END_TEST_METHOD()
+
+        BEGIN_TEST_METHOD(FocusedTextBoxAtCoreShutdown)
+            TEST_METHOD_PROPERTY(L"Description", L"Tear down the core with a focused TextBox still in the tree without faulting in input services.")
+            TEST_METHOD_PROPERTY(L"TestPass:IncludeOnlyOn", L"Desktop")
+            TEST_METHOD_PROPERTY(L"Hosting:Mode", L"UAP")
+        END_TEST_METHOD()
     };
 } } } } } }

From ab5e4ae4da621633e2b570f090bf6f13047927fc Mon Sep 17 00:00:00 2001
From: Abhijeet Jha <74712637+iamAbhi-916@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:11:54 +0530
Subject: [PATCH 2/2] Restore UTF-8 BOM on CoreShutdownTests.cpp

---
 .../external/framework/lifetime/tests/CoreShutdownTests.cpp     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.cpp b/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.cpp
index 4abe0cfbb1..06f0a1288c 100644
--- a/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.cpp
+++ b/dxaml/test/native/external/framework/lifetime/tests/CoreShutdownTests.cpp
@@ -1,4 +1,4 @@
-// Copyright (c) Microsoft Corporation. All rights reserved.
+// Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License. See LICENSE in the project root for license information.
 
 #include "pch.h"