System.Windows.Controls.Decorator.set_Child throws AccessViolationException

* .NET Core Version: 3.0 Preview8
* Windows version: 10.0.18362.295
* Does the bug reproduce also in WPF for .NET Framework 4.8?: Yes

**Problem description:**
I'm maintaining a WPF text editor control. The user's application will crash after doing the attached steps:
[JpImeBugSteps.zip](https://github.com/dotnet/wpf/files/3518437/JpImeBugSteps.zip)

When the app crashes, our control is removing the edit element to exit the edit state.
If we disable the edit element before removing it, the program won't crash.
We don't use `unsafe` in our control library.

**Actual behavior:**
```
(2ca0.24c4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
ntdll!LdrpDispatchUserCallTarget+0xe:
00007ffc`ef5cc53e 4f8b1cd3 mov r11,qword ptr [r11+r10*8] ds:00007dfb`46bb0510=????????????????
```
[JpImeBug_g.txt](https://github.com/dotnet/wpf/files/3518302/JpImeBug_g.txt)
[JpImeBug_k.txt](https://github.com/dotnet/wpf/files/3518304/JpImeBug_k.txt)
[JpImeBug_ClrStack.txt](https://github.com/dotnet/wpf/files/3518305/JpImeBug_ClrStack.txt)

**Expected behavior:**
`System.Windows.Controls.Decorator.set_Child` should not throw `AccessViolationException`. Either `COMException` or `InvalidOperationException` is acceptable.

**Minimal repro:**
I couldn't reproduce this issue without using our control.