Crash in cfgrelayex, Analyzed 2 dumps, total processed 52, rate equals 3.85%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
03efe17c 77df6ddc ntdll!RtlpAllocateHeap+0x1e
03efe218 77df5d7e ntdll!RtlpAllocateHeapInternal+0x104c
03efe234 76a937c5 ntdll!RtlAllocateHeap+0x3e
03efe36c 76a92d2d KERNELBASE!LocalBaseRegEnumValue+0x2a3
03efe3e8 76ddeebc KERNELBASE!RegEnumValueW+0xcd
03efe500 76dde721 gdi32full!CacheFontLinkingData+0x1c8
03efe520 76de0f74 gdi32full!IsFontRegLinked+0x28
03efeac8 76de1816 gdi32full!LoadFont+0x336
03efeaec 76de2039 gdi32full!FindOrCreateFaceCache+0x98
03efebf0 76de93f4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
03efef98 76de77f6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
03eff404 76de68ef gdi32full!ScriptStringAnalyse+0xa16
03eff58c 76de6140 gdi32full!LpkCharsetDraw+0x60f
03eff5b8 7744adfd gdi32full!LpkDrawTextEx+0x30
03eff614 7744ac94 user32!DT_DrawStr+0x5f
03eff674 7744a7cb user32!DT_GetLineBreak+0xa2
03eff744 7744a5ce user32!DrawTextExWorker+0x1f9
03eff760 72f2e6ea user32!DrawTextExW+0x1e
03eff7c4 72f2dd84 uxtheme!CTextDraw::GetTextExtent+0xa4
03eff80c 72f24349 uxtheme!GetThemeTextExtent+0x74
03eff860 72f30fa7 uxtheme!_GetNcCaptionTextSize+0x61
03eff954 72f3295c uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
03effa00 72f32a0f uxtheme!_WindowPosChangedWorker+0x7c
03effa0c 72f2f565 uxtheme!OnOwpPostWindowPosChanged+0x1f
03effa5c 77455ea3 uxtheme!ThemePostWndProc+0x355
03effb44 77455a7a user32!UserCallWinProcCheckWow+0x363
03effba8 7745ce97 user32!DispatchClientMessage+0xea
03effbe8 77e24e4d user32!__fnINLPWINDOWPOS+0x37
03effc38 72f4d4af ntdll!KiUserCallbackDispatcher+0x4d
03effc64 72f3010f uxtheme!OnOwpPreDwmCompositionChanged+0x4f
03effcc0 77455e4f uxtheme!ThemePreWndProc+0x43f
03effda8 77453bea user32!UserCallWinProcCheckWow+0x30f
03effe1c 774539b0 user32!DispatchMessageWorker+0x22a
03effe28 575ff5a1 user32!DispatchMessageW+0x10
03effe4c 575ff2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
03effeac 5760196f CfgRelayEx!CConfigCenterStub::Process+0xa7
03effeb8 5761ffcb CfgRelayEx!CThread::ThreadProc+0x1f
03effef4 761cfa29 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03efff04 77e17a4e kernel32!BaseThreadInitThunk+0x19
03efff60 77e17a1e ntdll!__RtlUserThreadStart+0x2f
03efff70 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
03f5e1e0 7697218f gdi32full!GetFontRealizationInfo+0x1c
03f5e790 7696802b gdi32full!LoadFont+0x70
03f5e7b4 76968182 gdi32full!FindOrCreateFaceCache+0xc7
03f5e8c0 76906ae5 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x128
03f5ec68 769074db gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2a5
03f5ed84 76908873 gdi32full!ScriptStringAnalyse+0x3eb
03f5ef08 76906733 gdi32full!LpkCharsetDraw+0xa93
03f5ef48 76a5f44b gdi32full!LpkDrawTextEx+0x203
03f5efac 76a5f351 user32!DT_DrawStr+0x69
03f5f004 76a5ef4e user32!DT_GetLineBreak+0xf8
03f5f0d4 76acd03e user32!DrawTextExWorker+0x1c4
03f5f0f0 6304fb54 user32!DrawTextExW+0x1e
03f5f154 63055b3a uxtheme!CTextDraw::GetTextExtent+0x109
03f5f19c 6304733d uxtheme!GetThemeTextExtent+0x8a
03f5f1f0 6301686a uxtheme!_GetNcCaptionTextSize+0x61
03f5f36c 63017bae uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
03f5f450 6301c2ef uxtheme!_WindowPosChangedWorker+0x73
03f5f45c 630190a6 uxtheme!OnOwpPostWindowPosChanged+0x1f
03f5f4c0 76a54510 uxtheme!ThemePostWndProc+0x356
03f5f5bc 76a53f6a user32!UserCallWinProcCheckWow+0x4f0
03f5f620 76a61357 user32!DispatchClientMessage+0xea
03f5f660 7775919d user32!__fnINLPWINDOWPOS+0x37
03f5f6b0 76e012ac ntdll!KiUserCallbackDispatcher+0x4d
03f5f6b4 630455bf win32u!NtUserSetWindowPos+0xc
03f5f6e0 6301a438 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
03f5f764 76a544b8 uxtheme!ThemePreWndProc+0x988
03f5f860 76a52da5 user32!UserCallWinProcCheckWow+0x498
03f5f8dc 76a528f0 user32!DispatchMessageWorker+0x4a5
03f5f8e8 58d2f5a1 user32!DispatchMessageW+0x10
03f5f90c 58d2f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
03f5f96c 58d3196f CfgRelayEx!CConfigCenterStub::Process+0xa7
03f5f978 58d4ffcb CfgRelayEx!CThread::ThreadProc+0x1f
03f5f9b4 76687ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03f5f9c4 7774c10b kernel32!BaseThreadInitThunk+0x19
03f5fa1c 7774c08f ntdll!__RtlUserThreadStart+0x2b
03f5fa2c 00000000 ntdll!_RtlUserThreadStart+0x1b