Crash in cfgrelayex, Analyzed 2 dumps, total processed 36, rate equals 5.56%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
0513f74c 0401b472 CfgRelayEx!CClientMgr::OnSlowCfgRefresh+0x15d
0513f764 04023390 CfgRelayEx!CClientMgr::OnReceiveMessage+0x42
0513f7c0 0402320f CfgRelayEx!CChannelImpl::ReceiveThreadImp+0x170
0513f7c8 0403ffcb CfgRelayEx!CChannelImpl::ReceiveThread+0xf
0513f804 763d343d CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0513f810 77b79812 kernel32!BaseThreadInitThunk+0xe
0513f850 77b797e5 ntdll!__RtlUserThreadStart+0x70
0513f868 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
048de058 76c91764 gdi32full!GetFontRealizationInfo+0x15
048de608 76c922d6 gdi32full!LoadFont+0x76
048de62c 76c92af9 gdi32full!FindOrCreateFaceCache+0x98
048de730 76c99eb4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
048dead8 76c982b6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
048def44 76c973af gdi32full!ScriptStringAnalyse+0xa16
048df0bc 76c977d8 gdi32full!LpkCharsetDraw+0x60f
048df188 76c9f192 gdi32full!GetTextMetricsW+0x108
048df1bc 7733cd3b gdi32full!IntersectClipRectImpl+0x42
048df28c 7733cb3e user32!DrawTextExWorker+0x1f9
048df2a8 6d81e71a user32!DrawTextExW+0x1e
048df30c 6d81dd84 uxtheme!CTextDraw::GetTextExtent+0xa4
048df354 6d8143e9 uxtheme!GetThemeTextExtent+0x74
048df3a8 6d820fc7 uxtheme!_GetNcCaptionTextSize+0x61
048df49c 6d82297c uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
048df548 6d822a2f uxtheme!_WindowPosChangedWorker+0x7c
048df554 6d81f595 uxtheme!OnOwpPostWindowPosChanged+0x1f
048df5a4 77348473 uxtheme!ThemePostWndProc+0x355
048df68c 7734804a user32!UserCallWinProcCheckWow+0x363
048df6f0 7734f467 user32!DispatchClientMessage+0xea
048df730 77a54fbd user32!__fnINLPWINDOWPOS+0x37
048df780 7757124c ntdll!KiUserCallbackDispatcher+0x4d
048df784 6d83d6cf win32u!NtUserSetWindowPos+0xc
048df7b0 6d82012f uxtheme!OnOwpPreDwmCompositionChanged+0x4f
048df80c 7734841f uxtheme!ThemePreWndProc+0x43f
048df8f4 773461ba user32!UserCallWinProcCheckWow+0x30f
048df968 77345f80 user32!DispatchMessageWorker+0x22a
048df974 78def5a1 user32!DispatchMessageW+0x10
048df998 78def2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
048df9f8 78df196f CfgRelayEx!CConfigCenterStub::Process+0xa7
048dfa04 78e0ffcb CfgRelayEx!CThread::ThreadProc+0x1f
048dfa40 770000f9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
048dfa50 77a47bbe kernel32!BaseThreadInitThunk+0x19
048dfaac 77a47b8e ntdll!__RtlUserThreadStart+0x2f
048dfabc 00000000 ntdll!_RtlUserThreadStart+0x1b