TabControl crash on Arrange

Description

In rare cases our program crashes with the following stacktrace, seen a couple of times when a user is closing a tab. It seems that the TabControl can end up in a state where it is reusing a stale value for _numRows.

Unhandled exception System.IndexOutOfRangeException: Indekset lå uden for matrixens grænser. ved System.Windows.Controls.Primitives.TabPanel.CalculateHeaderDistribution(Double rowWidthLimit, Double[] headerWidth) ved System.Windows.Controls.Primitives.TabPanel.ArrangeHorizontal(Size arrangeSize) ved System.Windows.Controls.Primitives.TabPanel.ArrangeOverride(Size arrangeSize) ved System.Windows.FrameworkElement.ArrangeCore(Rect finalRect) ved System.Windows.UIElement.Arrange(Rect finalRect) ved System.Windows.Controls.StackPanel.StackArrangeHelper(IStackMeasure arrangeElement, IStackMeasureScrollData scrollData, Size arrangeSize) ved System.Windows.Controls.StackPanel.ArrangeOverride(Size arrangeSize) ved System.Windows.FrameworkElement.ArrangeCore(Rect finalRect) ved System.Windows.UIElement.Arrange(Rect finalRect) ved System.Windows.Controls.Border.ArrangeOverride(Size finalSize) ved System.Windows.FrameworkElement.ArrangeCore(Rect finalRect) ved System.Windows.UIElement.Arrange(Rect finalRect) ... ved System.Windows.Controls.Decorator.ArrangeOverride(Size arrangeSize) ved System.Windows.Documents.AdornerDecorator.ArrangeOverride(Size finalSize) ved System.Windows.FrameworkElement.ArrangeCore(Rect finalRect) ved System.Windows.UIElement.Arrange(Rect finalRect) ved System.Windows.Controls.Grid.ArrangeOverride(Size arrangeSize) ved System.Windows.FrameworkElement.ArrangeCore(Rect finalRect) ved System.Windows.UIElement.Arrange(Rect finalRect) ved System.Windows.Window.ArrangeOverride(Size arrangeBounds) ved System.Windows.FrameworkElement.ArrangeCore(Rect finalRect) ved System.Windows.UIElement.Arrange(Rect finalRect) ved System.Windows.ContextLayoutManager.UpdateLayout() ved System.Windows.ContextLayoutManager.UpdateLayoutCallback(Object arg) ved System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks() ved System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object resizedCompositionTarget) ved System.Windows.Media.MediaContext.RenderMessageHandler(Object resizedCompositionTarget) ved System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs) ved System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)

Reproduction Steps

No manual repro

Expected behavior

No crash

Actual behavior

Crash

Regression?

Looking at the code it seems this crash has always been a possibility

Known Workarounds

None - no idea what catching the error would do - probably just cascade the failure somewhere else on stack.

Impact

Our application dies - leading to dataloss for customers.

Configuration

Seen on both Framework4.8 and net10 Seen on Windows versions across the last 2 years

Other information

No response