[cary-rowen]

In the DirectComposition candidate UI implementation introduced by PR #1927, when a popup or dialog takes focus during an active composition, the TSF host may terminate the composition before Weasel processes the focus loss. In the captured trace, CompositionTerminated is reported first, and _pComposition is already null when OnKillThreadFocus runs.

OnCompositionTerminated() clears _pComposition, so the subsequent _AbortComposition() cannot enter _EndComposition(). Before this fix, it only called CandidateList::Destroy(), which hid and destroyed the candidate window without calling ITfUIElementMgr::EndUIElement(). The TSF candidate UI therefore remained registered with _uiStarted == true, allowing later updates to reach the obsolete element. A screen reader could consequently continue to report the previous candidate content after the composition had ended.

When _AbortComposition() finds that the composition pointer is already gone, this fix calls CandidateList::EndUI() before the existing window cleanup. This ends the registered TSF UI element, resets _uiStarted, and leaves the normal active-composition path unchanged.

[lotem]

@fxliang 梁老師研究一下？

[cary-rowen]

这个 Bug 是用屏幕阅读器暴露出来的。
在键入过程中，只要存在未上屏的候选，若焦点被抢走就会复现这个问题（比如在微信里输入，恰巧来了语音通话）。
即使是挂断通话，再次切换回原本输入的窗口，那么每次移动焦点都会触发屏幕阅读器读一次先前未上屏的候选，尽管屏幕上没有显示任何候选窗口。
我通过打log排查到了这里并修复了它。
谢谢 @fxliang 老师！
如果没有什么问题希望能早日 merge 一下

[fxliang]

LGTM

[lotem]

感謝兩位積極修復！