Crash in cfgrelayex, Analyzed 3 dumps, total processed 110, rate equals 2.73%

Top 1: Version = 2.7224.1000.620, Total count = 3

dump count = 1

ChildEBP RetAddr  
04aff8b8 720717c9 uxtheme!CInternalNonclientMetrics::Acquire+0x1b
04aff8c8 72070f58 uxtheme!NcGetCaptionFont+0x2e
04aff9b0 7207293c uxtheme!CThemeWnd::GetNcWindowMetrics+0x2d8
04affa5c 720729ef uxtheme!_WindowPosChangedWorker+0x7c
04affa68 7206f545 uxtheme!OnOwpPostWindowPosChanged+0x1f
04affab8 75ba7ed3 uxtheme!ThemePostWndProc+0x355
04affba4 75ba7aaa user32!UserCallWinProcCheckWow+0x363
04affc08 75baf7f7 user32!DispatchClientMessage+0xea
04affc48 777654ed user32!__fnINLPWINDOWPOS+0x37
04affc98 75b5124c ntdll!KiUserCallbackDispatcher+0x4d
04affc9c 7208d44f win32u!NtUserSetWindowPos+0xc
04affcc8 720700ef uxtheme!OnOwpPreDwmCompositionChanged+0x4f
04affd24 75ba7e7f uxtheme!ThemePreWndProc+0x43f
04affe10 75ba67e1 user32!UserCallWinProcCheckWow+0x30f
04affe8c 75ba6300 user32!DispatchMessageWorker+0x4d1
04affe98 5e2ef5a1 user32!DispatchMessageW+0x10
04affebc 5e2ef2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
04afff1c 5e2f196f CfgRelayEx!CConfigCenterStub::Process+0xa7
04afff28 5e30ffcb CfgRelayEx!CThread::ThreadProc+0x1f
04afff64 76bffcc9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04afff74 777580ce kernel32!BaseThreadInitThunk+0x19
04afffd0 7775809e ntdll!__RtlUserThreadStart+0x2f
04afffe0 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0521e060 75a85d29 gdi32full!pcfLocateCFONT+0x6d
0521e3e0 75af1f6f gdi32full!GetFontRealizationInfo+0x109
0521e990 75ae7e0b gdi32full!LoadFont+0x70
0521e9b4 75ae7f62 gdi32full!FindOrCreateFaceCache+0xc7
0521eac0 75a86ad5 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x128
0521ee68 75a874cb gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2a5
0521ef84 75a88863 gdi32full!ScriptStringAnalyse+0x3eb
0521f128 75a86723 gdi32full!LpkCharsetDraw+0xa93
0521f168 74f6f57b gdi32full!LpkDrawTextEx+0x203
0521f1cc 74f6f481 user32!DT_DrawStr+0x69
0521f224 74f6f07e user32!DT_GetLineBreak+0xf8
0521f2f4 74fdcb2e user32!DrawTextExWorker+0x1c4
0521f310 66c809c4 user32!DrawTextExW+0x1e
0521f374 66c869aa uxtheme!CTextDraw::GetTextExtent+0x109
0521f3bc 66c781bd uxtheme!GetThemeTextExtent+0x8a
0521f410 66c4689a uxtheme!_GetNcCaptionTextSize+0x61
0521f588 66c47bde uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
0521f66c 66c4c30f uxtheme!_WindowPosChangedWorker+0x73
0521f678 66c490c0 uxtheme!OnOwpPostWindowPosChanged+0x1f
0521f6e0 74f64630 uxtheme!ThemePostWndProc+0x340
0521f7dc 74f6408a user32!UserCallWinProcCheckWow+0x4f0
0521f840 74f71487 user32!DispatchClientMessage+0xea
0521f880 76fb91bd user32!__fnINLPWINDOWPOS+0x37
0521f8d0 74df12ac ntdll!KiUserCallbackDispatcher+0x4d
0521f8d4 66c7643f win32u!NtUserSetWindowPos+0xc
0521f900 66c4a458 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0521f984 74f645d8 uxtheme!ThemePreWndProc+0x988
0521fa80 74f62ec5 user32!UserCallWinProcCheckWow+0x498
0521fafc 74f62a10 user32!DispatchMessageWorker+0x4a5
0521fb08 797ff5a1 user32!DispatchMessageW+0x10
0521fb2c 797ff2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0521fb8c 7980196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0521fb98 7981ffcb CfgRelayEx!CThread::ThreadProc+0x1f
0521fbd4 76737ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0521fbe4 76fac11b kernel32!BaseThreadInitThunk+0x19
0521fc3c 76fac09f ntdll!__RtlUserThreadStart+0x2b
0521fc4c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
055bfddc 0f428eda CfgRelayEx!strMgr
055bfdf4 0f428f54 CfgRelayEx!ATL::CSimpleStringT<wchar_t,0>::CSimpleStringT<wchar_t,0>+0x4a
055bfe14 0f42b549 CfgRelayEx!ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >+0x34
055bfe9c 0f42b472 CfgRelayEx!CClientMgr::OnSlowCfgRefresh+0xc9
055bfeb4 0f433390 CfgRelayEx!CClientMgr::OnReceiveMessage+0x42
055bff10 0f43320f CfgRelayEx!CChannelImpl::ReceiveThreadImp+0x170
055bff18 0f44ffcb CfgRelayEx!CChannelImpl::ReceiveThread+0xf
055bff54 759e343d CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
055bff60 77709812 kernel32!BaseThreadInitThunk+0xe
055bffa0 777097e5 ntdll!__RtlUserThreadStart+0x70
055bffb8 00000000 ntdll!_RtlUserThreadStart+0x1b