Fix crash on exit introduced in ac265aa (#10042)

ControlCore::AttachUiaEngine receives a IRenderEngine as a raw pointer,
which TermControl owns. We must ensure that we first destroy the
ControlCore before the UiaEngine instance (both owned by TermControl).
Otherwise a deallocated IRenderEngine is accessed when
ControlCore calls Renderer::TriggerTeardown.

This crash was introduced in #10031.

* [x] I work here
* [x] Tests added/passed

* Run accevent.exe to cause a UiaEngine to be attached to a TermControl.
* Close the current tab
* Ensured no crashes occur

(cherry picked from commit 43040ef)
(cherry picked from commit ad45139)

src/cascadia/TerminalControl/TermControl.cpp

@@ -641,27 +641,9 @@ namespace winrt::Microsoft::Terminal::Control::implementation
     {
         Close();
 
-        // Before destroying this instance we must ensure that we destroy the _renderer
-        // before the _renderEngine, as well as calling _renderer->TriggerTeardown().
-        // _renderEngine will be destroyed naturally after this ~destructor() returns.
-
-        decltype(_renderer) renderer;
-        {
-            // GH#8734:
-            // We lock the terminal here to make sure it isn't still being
-            // used in the connection thread before we destroy the renderer.
-            // However, we must unlock it again prior to triggering the
-            // teardown, to avoid the render thread being deadlocked. The
-            // renderer may be waiting to acquire the terminal lock, while
-            // we're waiting for the renderer to finish.
-            auto lock = _terminal->LockForWriting();
-
-            _renderer.swap(renderer);
-        }
-
-        if (renderer)
+        if (_renderer)
         {
-            renderer->TriggerTeardown();
+            _renderer->TriggerTeardown();
         }
     }
 

src/cascadia/TerminalControl/TermControl.h

@@ -130,9 +130,14 @@ namespace winrt::Microsoft::Terminal::Control::implementation
 
         std::unique_ptr<::Microsoft::Terminal::Core::Terminal> _terminal;
 
-        std::unique_ptr<::Microsoft::Console::Render::Renderer> _renderer;
+        // NOTE: All render engines must be ordered before _renderer.
+        //
+        // As _renderer has a dependency on the render engine (through a raw pointer)
+        // we must ensure the _renderer is deallocated first.
+        // (C++ class members are destroyed in reverse order.)
         std::unique_ptr<::Microsoft::Console::Render::DxEngine> _renderEngine;
         std::unique_ptr<::Microsoft::Console::Render::UiaEngine> _uiaEngine;
+        std::unique_ptr<::Microsoft::Console::Render::Renderer> _renderer;
 
         IControlSettings _settings;
         bool _focused;