Hi YYJ and welcome,
be careful, your debugger may mislead you - normally, the address on the stack frame back traced is the next instruction’s address, so your fault may likely have occurred without the function returning. Can you single step from xTaskScheduler() and see how far you come before faulting? Will a breakpoint on your sys tick handler be called?
Edit: Of course, it is also possible that system start up fails and exits the startup function (typically due to memory allocation failure), but that scenario rarely ends up in a fault.