Acces violation crash in Microsoft.ui.xaml.dll!CUIElement::Has3DDepthOnSelfOrSubtreeOrLTETargetingSelf()

Nobody has claimed this yet.

### Describe the bug

It's a crash that happens when in a WinUI3 C# .NET 10 project. I can't provide a repro project because it's an internal project.
However I can say it's related to a ComboBox (with 3 strings) that is shown at one moment. When replacing it by a list of radio buttons, the bug disappears.

### Why is this important?

It brings down the whole application.

### Steps to reproduce the bug

It happens all the time with my code and here's the full stack (can't share the app, it's internal)

```
[Exception thrown at 0x00007FFD287B5DE0 (Microsoft.ui.xaml.dll) in MyApp.exe: 0xC0000005: Access violation reading location 0x000000000000008C.]
Microsoft.ui.xaml.dll!CUIElement::Has3DDepthOnSelfOrSubtreeOrLTETargetingSelf() Line 688 C++
Microsoft.ui.xaml.dll!CUIElement::ComputeDepthInSubtree() Line 675 C++
Microsoft.ui.xaml.dll!CUIElement::UpdateHas3DDepthInSubtree() Line 853 C++
Microsoft.ui.xaml.dll!CUIElement::PropagateDepthInSubtree() Line 712 C++
Microsoft.ui.xaml.dll!CUIElement::UpdateHas3DDepthInSubtree() Line 858 C++
Microsoft.ui.xaml.dll!CUIElement::PropagateDepthInSubtree() Line 712 C++
Microsoft.ui.xaml.dll!CUIElement::UpdateHas3DDepthInSubtree() Line 858 C++
Microsoft.ui.xaml.dll!CUIElement::PropagateDepthInSubtree() Line 712 C++
Microsoft.ui.xaml.dll!CUIElement::UpdateHas3DDepthInSubtree() Line 858 C++
Microsoft.ui.xaml.dll!CUIElementCollection::OnChildrenChanged(CDependencyObject * pChildSender=0x0000000000000000) Line 3488 C++
Microsoft.ui.xaml.dll!CUIElementCollection::Remove(unsigned int nIndex=0, CDependencyObject * pObject=0x00000221cadb6400) Line 1217 C++
Microsoft.ui.xaml.dll!CUIElementCollection::RemoveAt(unsigned int nIndex=0) Line 1260 C++
Microsoft.ui.xaml.dll!CUIElement::RemoveChild(CUIElement * pChild=0x00000221cadb6400) Line 6945 C++
Microsoft.ui.xaml.dll!CControl::SetValue(const SetValueParams & args={...}) Line 71 C++
Microsoft.ui.xaml.dll!CItemsControl::SetValue(const SetValueParams & args={...}) Line 129 C++
Microsoft.ui.xaml.dll!CDependencyObject::UpdateEffectiveValue(const CDependencyObject::UpdateEffectiveValueParams & args={...}) Line 1927 C++
[Inline Frame] Microsoft.ui.xaml.dll!CDependencyObject::InvalidateProperty(const CDependencyProperty *) Line 362 C++
Microsoft.ui.xaml.dll!CFrameworkElement::InvalidateProperty(const CDependencyProperty * pDP=0x00007ffd29107cf0, BaseValueSource baseValueSource=BaseValueSourceStyle) Line 904 C++
Microsoft.ui.xaml.dll!CFrameworkElement::OnStyleChanged(CStyle * pOldStyle=0x00000221cad48b30, CStyle * pNewStyle=0x00000221ca4feeb0, BaseValueSource baseValueSource=BaseValueSourceStyle) Line 796 C++
Microsoft.ui.xaml.dll!CFrameworkElement::UpdateImplicitStyle(CStyle * pOldStyle=0x00000221cad48b30, CStyle * pNewStyle=0x0000000000000000, bool bForceUpdate=false, bool bUpdateChildren=false, bool isLeavingParentStyle=true) Line 653 C++
Microsoft.ui.xaml.dll!CFrameworkElement::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 2476 C++
Microsoft.ui.xaml.dll!CControl::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 397 C++
Microsoft.ui.xaml.dll!CItemsControl::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 275 C++
Microsoft.ui.xaml.dll!CDependencyObject::Leave(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 1196 C++
Microsoft.ui.xaml.dll!CDOCollection::ChildLeave(CDependencyObject * pChild, CDependencyObject * pNamescopeOwner, LeaveParams params, bool fCanProcessEnterLeave=true) Line 375 C++
Microsoft.ui.xaml.dll!CDOCollection::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 189 C++
Microsoft.ui.xaml.dll!CUIElementCollection::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 1185 C++
Microsoft.ui.xaml.dll!CDependencyObject::Leave(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 1196 C++
Microsoft.ui.xaml.dll!CUIElement::LeaveImpl(CDependencyObject * pNamescopeOwner=0x0000000000000000, LeaveParams params={...}) Line 1834 C++
Microsoft.ui.xaml.dll!CFrameworkElement::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 2460 C++
Microsoft.ui.xaml.dll!CDependencyObject::Leave(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 1196 C++
Microsoft.ui.xaml.dll!CDOCollection::ChildLeave(CDependencyObject * pChild, CDependencyObject * pNamescopeOwner, LeaveParams params, bool fCanProcessEnterLeave=true) Line 375 C++
Microsoft.ui.xaml.dll!CDOCollection::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 189 C++
Microsoft.ui.xaml.dll!CUIElementCollection::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 1185 C++
Microsoft.ui.xaml.dll!CDependencyObject::Leave(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 1196 C++
Microsoft.ui.xaml.dll!CUIElement::LeaveImpl(CDependencyObject * pNamescopeOwner=0x0000000000000000, LeaveParams params={...}) Line 1834 C++
Microsoft.ui.xaml.dll!CFrameworkElement::LeaveImpl(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 2460 C++
Microsoft.ui.xaml.dll!CDependencyObject::Leave(CDependencyObject * pNamescopeOwner=0x00000221ca573690, LeaveParams params={...}) Line 1196 C++
Microsoft.ui.xaml.dll!CDOCollection::ChildLeave(CDependencyObject * pChild, CDependencyObject * pNamescopeOwner, LeaveParams params, bool fCanProcessEnterLeave=true) Line 375 C++
Microsoft.ui.xaml.dll!CDOCollection::Neat(bool bBreak=true) Line 821 C++
Microsoft.ui.xaml.dll!CCollection::Destroy() Line 22 C++
Microsoft.ui.xaml.dll!CCollection::Clear() Line 59 C++
Microsoft.ui.xaml.dll!CUIElementCollection::RemoveAllElements(bool bTryUnloadingElements=true) Line 1301 C++
Microsoft.ui.xaml.dll!CoreImports::Collection_Clear(CCollection * pCollection=0x00000221cac83f60) Line 1458 C++
Microsoft.ui.xaml.dll!DirectUI::PresentationFrameworkCollectionTemplateBase::Clear() Line 663 C++
Microsoft.ui.xaml.dll!DirectUI::ItemsControl::ClearContainers(unsigned char bHostIsReplaced='\0') Line 591 C++
Microsoft.ui.xaml.dll!DirectUI::ItemsControl::ClearVisualChildren(CItemsControl * pNativeItemsControl, bool bHostIsReplaced=false) Line 435 C++
Microsoft.ui.xaml.dll!CItemsControl::InvalidateItemsHost(bool bHostIsReplaced=false) Line 338 C++
Microsoft.ui.xaml.dll!CItemsControl::SetValue(const SetValueParams & args={...}) Line 140 C++
Microsoft.ui.xaml.dll!CoreImports::DependencyObject_SetValue(CDependencyObject * pObject=0x00000221ca70aa00, const SetValueParams & args) Line 1866 C++
[Inline Frame] Microsoft.ui.xaml.dll!DirectUI::DependencyObject::SetValueCore(const SetValueParams &) Line 1132 C++
[Inline Frame] Microsoft.ui.xaml.dll!DirectUI::DependencyObject::SetValueCore(const CDependencyProperty *) Line 246 C++
Microsoft.ui.xaml.dll!DirectUI::DependencyObject::SetValueByKnownIndex(KnownPropertyIndex nPropertyIndex=ItemsControl_IsItemsHostInvalid, unsigned char value='\x1') Line 365 C++
[Inline Frame] Microsoft.ui.xaml.dll!DirectUI::ItemsControlGenerated::put_IsItemsHostInvalid(unsigned char) Line 114 C++
Microsoft.ui.xaml.dll!DirectUI::ItemsControl::ClearContainers(unsigned char bHostIsReplaced='\0') Line 576 C++
Microsoft.ui.xaml.dll!DirectUI::ItemsControl::OnGeneratorItemsChanged(IInspectable * pSender=0x000002217afef3f0, ABI::Microsoft::UI::Xaml::Controls::Primitives::IItemsChangedEventArgs * e=0x00000221c8439078) Line 1338 C++
Microsoft.ui.xaml.dll!DirectUI::ClassMemberEventHandler::Invoke(IInspectable * pSender=0x00000221ca6f1d40, ABI::Microsoft::UI::Xaml::Controls::Primitives::IItemsChangedEventArgs * pArgs=0x00000221c8439078) Line 663 C++
Microsoft.ui.xaml.dll!DirectUI::CEventSourceBase::Raise(IInspectable * pSource=0x00000221ca6f1d40, ABI::Microsoft::UI::Xaml::Controls::Primitives::IItemsChangedEventArgs * pArgs=0x00000221c8439078) Line 272 C++
Microsoft.ui.xaml.dll!DirectUI::ItemContainerGenerator::RaiseItemsChanged(ABI::Windows::Foundation::Collections::CollectionChange action=CollectionChange_Reset, ABI::Microsoft::UI::Xaml::Controls::Primitives::GeneratorPosition position, unsigned int nItemsCount=0, unsigned int nContainersCount=0) Line 2660 C++
Microsoft.ui.xaml.dll!DirectUI::ItemContainerGenerator::OnRefresh() Line 2629 C++
Microsoft.ui.xaml.dll!DirectUI::ItemContainerGenerator::OnItemCollectionChanged(ABI::Windows::Foundation::Collections::IObservableVector * pSender=0x00000221c80fe300, ABI::Windows::Foundation::Collections::IVectorChangedEventArgs * e=0x000001e106eca868) Line 2335 C++
Microsoft.ui.xaml.dll!DirectUI::ClassMemberEventHandler,ABI::Windows::Foundation::Collections::IObservableVector,ABI::Windows::Foundation::Collections::IVectorChangedEventArgs>::Invoke(ABI::Windows::Foundation::Collections::IObservableVector * pSender=0x00000221c80fe300, ABI::Windows::Foundation::Collections::IVectorChangedEventArgs * pArgs=0x000001e106eca868) Line 663 C++
Microsoft.ui.xaml.dll!DirectUI::CEventSourceBase,ABI::Windows::Foundation::Collections::IObservableVector,ABI::Windows::Foundation::Collections::IVectorChangedEventArgs>::Raise(ABI::Windows::Foundation::Collections::IObservableVector * pSource=0x00000221c80fe300, ABI::Windows::Foundation::Collections::IVectorChangedEventArgs * pArgs=0x000001e106eca868) Line 306 C++
Microsoft.ui.xaml.dll!DirectUI::ItemCollection::OnCollectionChanged(ABI::Windows::Foundation::Collections::IObservableVector * pSender=0x00000221c80fe300, ABI::Windows::Foundation::Collections::IVectorChangedEventArgs * e=0x000001e106eca868) Line 388 C++
Microsoft.ui.xaml.dll!DirectUI::ItemCollection::UpdateItemsSourceList::__l23::::operator()(IInspectable * args=0x000001e106eca868, ABI::Windows::Foundation::Collections::IVectorChangedEventArgs *) Line 349 C++
[Inline Frame] Microsoft.ui.xaml.dll!std::_Func_class *,ABI::Windows::Foundation::Collections::IVectorChangedEventArgs *>::operator()(ABI::Windows::Foundation::Collections::IObservableVector * <_Args_0>=0x00000221ca4e07d0, ABI::Windows::Foundation::Collections::IVectorChangedEventArgs * <_Args_1>=0x000001e106eca868) Line 926 C++
Microsoft.ui.xaml.dll!ctl::event_handler_base,ABI::Windows::Foundation::Collections::IObservableVector,ABI::Windows::Foundation::Collections::IVectorChangedEventArgs,DirectUI::VectorChangedTraits>::Invoke(ABI::Windows::Foundation::Collections::IObservableVector * pSender, ABI::Windows::Foundation::Collections::IVectorChangedEventArgs * pArgs) Line 35 C++
Microsoft.ui.xaml.dll!DirectUI::TrackerEventSource,ABI::Windows::Foundation::Collections::IObservableVector,ABI::Windows::Foundation::Collections::IVectorChangedEventArgs>::Raise(ABI::Windows::Foundation::Collections::IObservableVector * pSource=0x00000221ca4e07d0, ABI::Windows::Foundation::Collections::IVectorChangedEventArgs * pArgs=0x000001e106eca868) Line 574 C++
[Inline Frame] Microsoft.ui.xaml.dll!DirectUI::BindableObservableVectorWrapper::RaiseVectorChanged(ABI::Windows::Foundation::Collections::IVectorChangedEventArgs *) Line 276 C++
Microsoft.ui.xaml.dll!DirectUI::BindableObservableVectorWrapper::RaiseVectorChanged(ABI::Windows::Foundation::Collections::CollectionChange action=CollectionChange_Reset, unsigned int index=0) Line 264 C++
Microsoft.ui.xaml.dll!DirectUI::BindableObservableVectorWrapper::ProcessCollectionChange(ABI::Microsoft::UI::Xaml::Interop::INotifyCollectionChangedEventArgs * pArgs=0x00000221c8bd1928) Line 226 C++
[Inline Frame] Microsoft.ui.xaml.dll!std::_Func_class::operator()(ABI::Microsoft::UI::Xaml::Controls::ICalendarView * <_Args_0>=0x00000221ca55fb78, ABI::Microsoft::UI::Xaml::Controls::ICalendarViewSelectedDatesChangedEventArgs * <_Args_1>=0x00000221c8bd1928) Line 926 C++
Microsoft.ui.xaml.dll!ctl::event_handler_base,ABI::Microsoft::UI::Xaml::Controls::ICalendarView,ABI::Microsoft::UI::Xaml::Controls::ICalendarViewSelectedDatesChangedEventArgs,DirectUI::CalendarViewSelectedDatesChangedTraits>::Invoke(ABI::Microsoft::UI::Xaml::Controls::ICalendarView * pSender, ABI::Microsoft::UI::Xaml::Controls::ICalendarViewSelectedDatesChangedEventArgs * pArgs) Line 35 C++
[Managed to Native Transition]
> WinRT.Runtime.dll!ABI.System.Collections.Specialized.NotifyCollectionChangedEventHandler.NativeDelegateWrapper.Invoke(object sender = Count = 0, System.Collections.Specialized.NotifyCollectionChangedEventArgs e = {System.Collections.Specialized.NotifyCollectionChangedEventArgs}) Line 63 C#
System.ObjectModel.dll!System.Collections.ObjectModel.ObservableCollection.OnCollectionChanged(System.Collections.Specialized.NotifyCollectionChangedEventArgs e) Line 192 C#
MyApp.dll!MyApp.Controls.ParametersViewModel.Rebuild() Line 62 C#
MyApp.dll!MyApp.Controls.MyView.CreateMyLayers.AnonymousMethod__127_0() Line 20 C#
MyApp.dll!MyApp.Controls.MyLayer.OnSelectionChanged() Line 55 C#
MyApp.dll!MyApp.Controls.MyLayer.FinalizeMarquee(System.Numerics.Vector2 min = {System.Numerics.Vector2}, System.Numerics.Vector2 max = {System.Numerics.Vector2}, bool isDrag = true, MyModel.Shape tap = null) Line 260 C#
MyApp.dll!MyApp.Controls.MyView.TryMarqueeReleased(Microsoft.UI.Input.PointerPoint point = {Microsoft.UI.Input.PointerPoint}, Microsoft.UI.Xaml.Input.PointerRoutedEventArgs e = {Microsoft.UI.Xaml.Input.PointerRoutedEventArgs}) Line 288 C#
MyApp.dll!MyApp.Controls.MyView.OnPointerEnded(object sender = {Microsoft.UI.Xaml.Controls.Border}, Microsoft.UI.Xaml.Input.PointerRoutedEventArgs e = {Microsoft.UI.Xaml.Input.PointerRoutedEventArgs}) Line 1054 C#
Microsoft.WinUI.dll!ABI.Microsoft.UI.Xaml.Input.PointerEventHandler.Do_Abi_Invoke(nint thisPtr, nint sender, nint e) Line 10698 C#

```

### Actual behavior

Crash

### Expected behavior

Crash should not happen.

### Screenshots

_No response_

### NuGet package version

Microsoft.WindowsAppSDK 2.2.0

### Windows version

_No response_

### Additional context

Here are package references:

Microsoft.UI.dll FileVersion is 10.0.27200.1024 (WinBuild.160101.0800)
Microsoft.UI.Xaml.dll & Microsoft.UI.Xaml.Controls.dll FileVersion is 3.2.2.2606 (4BE719264AFE(ContainerAdministrator)-ae599905d3e3837cfe1335178ebcc2bf953a3da7)

Start from the reported stack entry CUIElement::Has3DDepthOnSelfOrSubtreeOrLTETargetingSelf() and follow the calls through CUIElementCollection::OnChildrenChanged and ItemsControl::ClearContainers. The report provides no reproducible project or named repository files, so first isolate a minimal WinUI 3 ComboBox scenario matching the collection and style changes. Done means the access violation is reproducibly prevented and covered by an appropriate regression test.

Written by the indexing model from the issue text.