Crash in cfgrelayex, Analyzed 2 dumps, total processed 56, rate equals 3.57%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
03d5e058 765d79fc gdi32full!pcfLocateCFONT+0x67
03d5e3d8 765d1bde gdi32full!GetFontRealizationInfo+0xdc
03d5e988 765d29fc gdi32full!LoadFont+0x76
03d5e9ac 765d34f3 gdi32full!FindOrCreateFaceCache+0x98
03d5eab0 765dadf4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
03d5ee58 765d91f6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
03d5f2c4 765d82ef gdi32full!ScriptStringAnalyse+0xa16
03d5f43c 765d8718 gdi32full!LpkCharsetDraw+0x60f
03d5f508 765e0092 gdi32full!GetTextMetricsW+0x108
03d5f53c 7638cf9b gdi32full!IntersectClipRectImpl+0x42
03d5f60c 7638cd9e user32!DrawTextExWorker+0x1f9
03d5f628 719be6ca user32!DrawTextExW+0x1e
03d5f68c 719bdd34 uxtheme!CTextDraw::GetTextExtent+0xa4
03d5f6d4 719b43c9 uxtheme!GetThemeTextExtent+0x74
03d5f728 719c0f87 uxtheme!_GetNcCaptionTextSize+0x61
03d5f818 719c293c uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
03d5f8c4 719c29ef uxtheme!_WindowPosChangedWorker+0x7c
03d5f8d0 719bf545 uxtheme!OnOwpPostWindowPosChanged+0x1f
03d5f920 76397f93 uxtheme!ThemePostWndProc+0x355
03d5fa0c 76397b6a user32!UserCallWinProcCheckWow+0x363
03d5fa70 7639f8d7 user32!DispatchClientMessage+0xea
03d5fab0 773e54ed user32!__fnINLPWINDOWPOS+0x37
03d5fb00 768b124c ntdll!KiUserCallbackDispatcher+0x4d
03d5fb04 719dd44f win32u!NtUserSetWindowPos+0xc
03d5fb30 719c00ef uxtheme!OnOwpPreDwmCompositionChanged+0x4f
03d5fb8c 76397f3f uxtheme!ThemePreWndProc+0x43f
03d5fc78 763968a1 user32!UserCallWinProcCheckWow+0x30f
03d5fcf4 763963c0 user32!DispatchMessageWorker+0x4d1
03d5fd00 66fdf5a1 user32!DispatchMessageW+0x10
03d5fd24 66fdf2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
03d5fd84 66fe196f CfgRelayEx!CConfigCenterStub::Process+0xa7
03d5fd90 66ffffcb CfgRelayEx!CThread::ThreadProc+0x1f
03d5fdcc 755afcc9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03d5fddc 773d80ce kernel32!BaseThreadInitThunk+0x19
03d5fe38 773d809e ntdll!__RtlUserThreadStart+0x2f
03d5fe48 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

04d7fe18 760e386d CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04d7fe24 77ae96f2 kernel32!BaseThreadInitThunk+0xe
04d7fe64 77ae96c5 ntdll!__RtlUserThreadStart+0x70
04d7fe7c 00000000 ntdll!_RtlUserThreadStart+0x1b