Crash in cfgrelayex, Analyzed 4 dumps, total processed 65, rate equals 6.15%

Top 1: Version = 2.7224.1000.620, Total count = 4

dump count = 1

ChildEBP RetAddr  
0397e118 76c106c6 gdi32full!GetFontRealizationInfo+0x15
0397e6c8 76c11226 gdi32full!LoadFont+0x76
0397e6ec 76c117b0 gdi32full!FindOrCreateFaceCache+0x98
0397e7f0 76c18e54 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
0397eb98 76c17256 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
0397f004 76c1634f gdi32full!ScriptStringAnalyse+0xa16
0397f1a4 76c15ba0 gdi32full!LpkCharsetDraw+0x60f
0397f1d0 77149fed gdi32full!LpkDrawTextEx+0x30
0397f22c 77149e84 user32!DT_DrawStr+0x5f
0397f28c 771499bb user32!DT_GetLineBreak+0xa2
0397f35c 771497be user32!DrawTextExWorker+0x1f9
0397f378 70f7e8ba user32!DrawTextExW+0x1e
0397f3dc 70f7df54 uxtheme!CTextDraw::GetTextExtent+0xa4
0397f424 70f74429 uxtheme!GetThemeTextExtent+0x74
0397f478 70f81167 uxtheme!_GetNcCaptionTextSize+0x61
0397f56c 70f82b1c uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
0397f618 70f82bcf uxtheme!_WindowPosChangedWorker+0x7c
0397f624 70f7f735 uxtheme!OnOwpPostWindowPosChanged+0x1f
0397f674 77154733 uxtheme!ThemePostWndProc+0x355
0397f75c 7715430a user32!UserCallWinProcCheckWow+0x363
0397f7c0 7715b937 user32!DispatchClientMessage+0xea
0397f800 7734357d user32!__fnINLPWINDOWPOS+0x37
0397f850 70f9d7bf ntdll!KiUserCallbackDispatcher+0x4d
0397f87c 70f802cf uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0397f8d8 771546df uxtheme!ThemePreWndProc+0x43f
0397f9c0 77152a3a user32!UserCallWinProcCheckWow+0x30f
0397fa34 77152800 user32!DispatchMessageWorker+0x22a
0397fa40 7b47f5a1 user32!DispatchMessageW+0x10
0397fa64 7b47f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0397fac4 7b48196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0397fad0 7b49ffcb CfgRelayEx!CThread::ThreadProc+0x1f
0397fb0c 7658f989 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0397fb1c 77337084 kernel32!BaseThreadInitThunk+0x19
0397fb78 77337054 ntdll!__RtlUserThreadStart+0x2f
0397fb88 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0399e058 76f85fcc gdi32full!pcfLocateCFONT+0x67
0399e3d8 76f80c84 gdi32full!GetFontRealizationInfo+0xdc
0399e988 76f817e6 gdi32full!LoadFont+0x76
0399e9ac 76f82009 gdi32full!FindOrCreateFaceCache+0x98
0399eab0 76f893c4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
0399ee58 76f877c6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
0399f2c4 76f868bf gdi32full!ScriptStringAnalyse+0xa16
0399f444 76f86110 gdi32full!LpkCharsetDraw+0x60f
0399f470 773cce4d gdi32full!LpkDrawTextEx+0x30
0399f4cc 773ccce4 user32!DT_DrawStr+0x5f
0399f52c 773cc81b user32!DT_GetLineBreak+0xa2
0399f5fc 773cc61e user32!DrawTextExWorker+0x1f9
0399f618 69c0e77a user32!DrawTextExW+0x1e
0399f67c 69c0de14 uxtheme!CTextDraw::GetTextExtent+0xa4
0399f6c4 69c043e9 uxtheme!GetThemeTextExtent+0x74
0399f718 69c11027 uxtheme!_GetNcCaptionTextSize+0x61
0399f80c 69c129dc uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
0399f8b8 69c12a8f uxtheme!_WindowPosChangedWorker+0x7c
0399f8c4 69c0f5f5 uxtheme!OnOwpPostWindowPosChanged+0x1f
0399f914 773d7ef3 uxtheme!ThemePostWndProc+0x355
0399f9fc 773d7aca user32!UserCallWinProcCheckWow+0x363
0399fa60 773deef7 user32!DispatchClientMessage+0xea
0399faa0 77d94e9d user32!__fnINLPWINDOWPOS+0x37
0399faf0 7783124c ntdll!KiUserCallbackDispatcher+0x4d
0399faf4 69c2d7ef win32u!NtUserSetWindowPos+0xc
0399fb20 69c1018f uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0399fb7c 773d7e9f uxtheme!ThemePreWndProc+0x43f
0399fc64 773d5c3a user32!UserCallWinProcCheckWow+0x30f
0399fcd8 773d5a00 user32!DispatchMessageWorker+0x22a
0399fce4 7cc0f5a1 user32!DispatchMessageW+0x10
0399fd08 7cc0f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0399fd68 7cc1196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0399fd74 7cc2ffcb CfgRelayEx!CThread::ThreadProc+0x1f
0399fdb0 770ffa29 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0399fdc0 77d87a9e kernel32!BaseThreadInitThunk+0x19
0399fe1c 77d87a6e ntdll!__RtlUserThreadStart+0x2f
0399fe2c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0043f834 77e1e0c3 ntdll!RtlpLowFragHeapFree+0xc5
0043f84c 75ba14bd ntdll!RtlFreeHeap+0x105
0043f860 63342d01 kernel32!HeapFree+0x14
0043f874 6334b21e CfgRelayEx!_free_base+0x1c
0043f88c 6334b53f CfgRelayEx!free_crt_array_internal+0x2e
0043f8a0 63348c3a CfgRelayEx!__acrt_locale_free_time+0x96
0043f8b0 63348b7e CfgRelayEx!__acrt_locale_free_lc_time_if_unreferenced+0x25
0043f8cc 63342b55 CfgRelayEx!__acrt_free_locale+0xdc
0043f8dc 633428d2 CfgRelayEx!replace_current_thread_locale_nolock+0x36
0043f914 633429b0 CfgRelayEx!__crt_seh_guarded_call<void>::operator()<<lambda_5b71d36f03204c0beab531769a5b5694>,<lambda_be2b3da3f62db62e9dad5dc70221a656> &,<lambda_8f9ce462984622f9bf76b59e2aaaf805> >+0x29
0043f934 63342b18 CfgRelayEx!__acrt_lock_and_call<<lambda_be2b3da3f62db62e9dad5dc70221a656> >+0x24
0043f974 63342a68 CfgRelayEx!destroy_ptd+0xa2
0043f980 77e495c5 CfgRelayEx!destroy_fls+0x13
0043f9a0 76a14008 ntdll!RtlFlsFree+0xa0
0043f9ac 63346c1b KERNELBASE!FlsFree+0xe
0043f9c0 63342cdb CfgRelayEx!__acrt_FlsFree+0x3d
0043f9c8 633412f7 CfgRelayEx!__acrt_uninitialize_ptd+0x10
0043f9d4 63328dfd CfgRelayEx!__acrt_uninitialize_critical+0xd
0043f9dc 6332931e CfgRelayEx!__scrt_dllmain_uninitialize_critical+0x7
0043f9e0 633292f4 CfgRelayEx!dllmain_crt_process_detach+0x80
0043fa14 6332918f CfgRelayEx!dllmain_crt_process_detach+0x56
0043fa20 633293df CfgRelayEx!dllmain_crt_dispatch+0x4e
0043fa60 6332947d CfgRelayEx!dllmain_dispatch+0xaf
0043fa74 77e29264 CfgRelayEx!_DllMainCRTStartup+0x1c
0043fa94 77e48fa8 ntdll!LdrpCallInitRoutine+0x14
0043fb38 77e48e4a ntdll!LdrShutdownProcess+0x1aa
0043fb4c 75ba7a3c ntdll!RtlExitUserProcess+0x74
0043fb60 010b275a kernel32!ExitProcessStub+0x12
0043fb6c 010b26ef srvhost!exit_or_terminate_process+0x40
0043fba4 010b2895 srvhost!common_exit+0xee
0043fbb8 010a7e90 srvhost!exit+0x11
0043fbf8 75ba344d srvhost!__scrt_common_main_seh+0x179
0043fc04 77e29802 kernel32!BaseThreadInitThunk+0xe
0043fc44 77e297d5 ntdll!__RtlUserThreadStart+0x70
0043fc5c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
03a3e0c0 74e7956d gdi32full!GetFontRealizationInfo+0x1c
03a3e670 74e7c46d gdi32full!LoadFont+0x70
03a3e694 74e7afad gdi32full!FindOrCreateFaceCache+0x98
03a3e798 74e491cd gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
03a3eb38 74e495b6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x27d
03a3ec44 74e4762a gdi32full!ScriptStringAnalyse+0x3a6
03a3edf4 74e46880 gdi32full!LpkCharsetDraw+0x62a
03a3ee20 74acde42 gdi32full!LpkDrawTextEx+0x30
03a3eeac 74acd83d user32!DT_GetLineBreak+0x122
03a3ef6c 74af320e user32!DrawTextExWorker+0x1ed
03a3ef88 66c1b6c6 user32!DrawTextExW+0x1e
03a3f3e8 66c1de2b uxtheme!CThemeWnd::GetNcWindowMetrics+0x8b6
03a3f494 66c1debf uxtheme!_WindowPosChangedWorker+0x77
03a3f4a0 66c1a525 uxtheme!OnOwpPostWindowPosChanged+0x1f
03a3f4f4 74ad5043 uxtheme!ThemePostWndProc+0x405
03a3f5dc 74ad4b2a user32!UserCallWinProcCheckWow+0x463
03a3f640 74ade9c7 user32!DispatchClientMessage+0xea
03a3f680 76f8428d user32!__fnINLPWINDOWPOS+0x37
03a3f6d0 66c4379f ntdll!KiUserCallbackDispatcher+0x4d
03a3f6fc 66c1ac20 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
03a3f758 74ad5016 uxtheme!ThemePreWndProc+0x610
03a3f840 74ad40de user32!UserCallWinProcCheckWow+0x436
03a3f8b4 74ad3ec0 user32!DispatchMessageWorker+0x20e
03a3f8c0 790bf5a1 user32!DispatchMessageW+0x10
03a3f8e4 790bf2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
03a3f944 790c196f CfgRelayEx!CConfigCenterStub::Process+0xa7
03a3f950 790dffcb CfgRelayEx!CThread::ThreadProc+0x1f
03a3f98c 747d6359 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03a3f99c 76f77c24 kernel32!BaseThreadInitThunk+0x19
03a3f9f8 76f77bf4 ntdll!__RtlUserThreadStart+0x2f
03a3fa08 00000000 ntdll!_RtlUserThreadStart+0x1b