Crash in cfgrelayex, Analyzed 2 dumps, total processed 103, rate equals 1.94%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
004af804 77092c35 ntdll!RtlpFreeHeap+0x4d6
004af824 770b175e ntdll!RtlFreeHeap+0x142
004af874 770977a3 ntdll!RtlpFreeUserBlock+0x11d
004af8b0 7708e0f3 ntdll!RtlpLowFragHeapFree+0x2c1
004af8c8 757314ad ntdll!RtlFreeHeap+0x105
004af8dc 6f312d01 kernel32!HeapFree+0x14
004af8f0 6f2f8ca4 CfgRelayEx!_free_base+0x1c
004af8fc 6f30ab12 CfgRelayEx!operator delete+0xb
004af918 6f30aaed CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x42
004af930 6f30aaed CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x1d
004af948 6f3251e3 CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x1d
004af96c 6f310f53 CfgRelayEx!ATL::`dynamic atexit destructor for '_AtlBaseModule''+0x7a9
004af998 6f310e31 CfgRelayEx!<lambda_275893d493268fdec8709772e3fcec0e>::operator()+0x89
004af9cc 6f310e7f CfgRelayEx!__crt_seh_guarded_call<int>::operator()<<lambda_995298e7d72eb4c2aab26c0585b3abe5>,<lambda_275893d493268fdec8709772e3fcec0e> &,<lambda_293819299cbf9a7022e18b56a874bb5c> >+0x27
004af9ec 6f311158 CfgRelayEx!__acrt_lock_and_call<<lambda_275893d493268fdec8709772e3fcec0e> >+0x24
004afa00 6f310714 CfgRelayEx!_execute_onexit_table+0x17
004afa38 6f310895 CfgRelayEx!common_exit+0xa1
004afa48 6f2f92d7 CfgRelayEx!_cexit+0xb
004afa7c 6f2f918f CfgRelayEx!dllmain_crt_process_detach+0x39
004afa88 6f2f93df CfgRelayEx!dllmain_crt_dispatch+0x4e
004afac8 6f2f947d CfgRelayEx!dllmain_dispatch+0xaf
004afadc 77099280 CfgRelayEx!_DllMainCRTStartup+0x1c
004afafc 770b8f88 ntdll!LdrpCallInitRoutine+0x14
004afba0 770b8e2a ntdll!LdrShutdownProcess+0x1aa
004afbb4 75737a3c ntdll!RtlExitUserProcess+0x74
004afbc8 0027275a kernel32!ExitProcessStub+0x12
004afbd4 002726ef srvhost!exit_or_terminate_process+0x40
004afc0c 00272895 srvhost!common_exit+0xee
004afc20 00267e90 srvhost!exit+0x11
004afc60 7573343d srvhost!__scrt_common_main_seh+0x179
004afc6c 77099812 kernel32!BaseThreadInitThunk+0xe
004afcac 770997e5 ntdll!__RtlUserThreadStart+0x70
004afcc4 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

04d5f128 7694f4eb gdi32full!LpkDrawTextEx+0x203
04d5f1c4 74e2c902 user32!DT_DrawStr+0x69
04d5f2d0 70b30174 gdi32!IntersectClipRect+0x22
04d5f334 70b3616a uxtheme!CTextDraw::GetTextExtent+0x109
04d5f37c 70b2796d uxtheme!GetThemeTextExtent+0x8a
04d5f3d0 70af686a uxtheme!_GetNcCaptionTextSize+0x61
04d5f548 70af7bae uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
04d5f62c 70afc2df uxtheme!_WindowPosChangedWorker+0x73
04d5f638 70af9090 uxtheme!OnOwpPostWindowPosChanged+0x1f
04d5f6a0 769445c0 uxtheme!ThemePostWndProc+0x340
04d5f79c 7694401a user32!UserCallWinProcCheckWow+0x4f0
04d5f800 769513f7 user32!DispatchClientMessage+0xea
04d5f840 76fb919d user32!__fnINLPWINDOWPOS+0x37
04d5f890 755912ac ntdll!KiUserCallbackDispatcher+0x4d
04d5f894 70b25bef win32u!NtUserSetWindowPos+0xc
04d5f8c0 70afa428 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
04d5fa28 76fb919d uxtheme!ThemePreWndProc+0x988
04d5fac8 56c6f5a1 ntdll!KiUserCallbackDispatcher+0x4d
04d5faec 56c6f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
04d5fb4c 56c7196f CfgRelayEx!CConfigCenterStub::Process+0xa7
04d5fb58 56c8ffcb CfgRelayEx!CThread::ThreadProc+0x1f
04d5fb94 755c7ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04d5fba4 76fac10b kernel32!BaseThreadInitThunk+0x19
04d5fbfc 76fac08f ntdll!__RtlUserThreadStart+0x2b
04d5fc0c 00000000 ntdll!_RtlUserThreadStart+0x1b