TextStore: attach-time TSF reentrancy can desync _netCharCount before consistency checks

[etvorun]

Summary

We found a TextStore attach-time reentrancy issue where TSF callbacks can arrive during TextStore.OnAttach() before all attach-time state is fully safe, leading to consistency failures in IME-heavy scenarios.

Observed behavior

RegisterTextStore can synchronously re-enter WPF while OnAttach() is still running. In this window, attach/focus-time edits can occur before text-change tracking is fully established, and _netCharCount can drift from TextContainer.IMECharCount.

The resulting failure mode is a later consistency assert/fail-fast path (for example in VerifyTextStoreConsistency).

Repro notes

• We were able to reproduce this deterministically with a custom native TSF Text Input Processor (TIP) test DLL that forces attach/focus-time edit sessions and callback timing similar to third-party IMEs.
• We also observed similar behavior characteristics with WeChat Input Method (a TSF TIP/IME engine).

Proposed fix direction

In TextStore.OnAttach(), subscribe to TextContainer.Change before RegisterTextStore, so registration-time text edits are observed immediately and _netCharCount remains synchronized.

(Initialization ordering for callback-facing state should also remain safe before registration.)

Why this should be considered upstream

This is a TSF callback timing/reentrancy shape that can happen with real third-party IMEs. Fixing the attach-time ordering in WPF TextStore improves robustness for the broader ecosystem, not only a fork-specific scenario.