Crash in cfgrelayex, Analyzed 3 dumps, total processed 61, rate equals 4.92%

Top 1: Version = 2.7224.1000.620, Total count = 3

dump count = 1

ChildEBP RetAddr  
0023f4f8 76f0e0f3 ntdll!RtlpLowFragHeapFree+0xc5
0023f510 74da14ad ntdll!RtlFreeHeap+0x105
0023f524 58472d01 kernel32!HeapFree+0x14
0023f538 5846c025 CfgRelayEx!_free_base+0x1c
0023f544 76f395a5 CfgRelayEx!__vcrt_freefls+0x17
0023f564 765e4008 ntdll!RtlFlsFree+0xa0
0023f570 5846d220 KERNELBASE!FlsFree+0xe
0023f580 5846c143 CfgRelayEx!__vcrt_FlsFree+0x30
0023f588 5846bfac CfgRelayEx!__vcrt_uninitialize_ptd+0x10
0023f58c 5845931e CfgRelayEx!__vcrt_uninitialize_critical+0x5
0023f590 584592f4 CfgRelayEx!dllmain_crt_process_detach+0x80
0023f5c4 5845918f CfgRelayEx!dllmain_crt_process_detach+0x56
0023f5d0 584593df CfgRelayEx!dllmain_crt_dispatch+0x4e
0023f610 5845947d CfgRelayEx!dllmain_dispatch+0xaf
0023f624 76f19280 CfgRelayEx!_DllMainCRTStartup+0x1c
0023f644 76f38f88 ntdll!LdrpCallInitRoutine+0x14
0023f6e8 76f38e2a ntdll!LdrShutdownProcess+0x1aa
0023f6fc 74da7a3c ntdll!RtlExitUserProcess+0x74
0023f710 0034275a kernel32!ExitProcessStub+0x12
0023f71c 003426ef srvhost!exit_or_terminate_process+0x40
0023f754 00342895 srvhost!common_exit+0xee
0023f768 00337e90 srvhost!exit+0x11
0023f7a8 74da343d srvhost!__scrt_common_main_seh+0x179
0023f7b4 76f19812 kernel32!BaseThreadInitThunk+0xe
0023f7f4 76f197e5 ntdll!__RtlUserThreadStart+0x70
0023f80c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
04d3e360 76381f6f gdi32full!GetFontRealizationInfo+0x20
04d3e910 76377e0b gdi32full!LoadFont+0x70
04d3e934 76377f62 gdi32full!FindOrCreateFaceCache+0xc7
04d3ea40 76316ad5 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x128
04d3ede8 763174cb gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2a5
04d3ef04 76318863 gdi32full!ScriptStringAnalyse+0x3eb
04d3f080 76316723 gdi32full!LpkCharsetDraw+0xa93
04d3f0c0 7734f57b gdi32full!LpkDrawTextEx+0x203
04d3f124 7734f481 user32!DT_DrawStr+0x69
04d3f17c 7734f07e user32!DT_GetLineBreak+0xf8
04d3f24c 773bcb2e user32!DrawTextExWorker+0x1c4
04d3f268 66e709c4 user32!DrawTextExW+0x1e
04d3f2cc 66e769aa uxtheme!CTextDraw::GetTextExtent+0x109
04d3f314 66e681bd uxtheme!GetThemeTextExtent+0x8a
04d3f368 66e3689a uxtheme!_GetNcCaptionTextSize+0x61
04d3f4e0 66e37bde uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
04d3f5c4 66e3c30f uxtheme!_WindowPosChangedWorker+0x73
04d3f5d0 66e390c0 uxtheme!OnOwpPostWindowPosChanged+0x1f
04d3f638 77344630 uxtheme!ThemePostWndProc+0x340
04d3f734 7734408a user32!UserCallWinProcCheckWow+0x4f0
04d3f798 77351487 user32!DispatchClientMessage+0xea
04d3f7d8 778191bd user32!__fnINLPWINDOWPOS+0x37
04d3f828 75cc12ac ntdll!KiUserCallbackDispatcher+0x4d
04d3f82c 66e6643f win32u!NtUserSetWindowPos+0xc
04d3f858 66e3a458 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
04d3f8d8 773445d8 uxtheme!ThemePreWndProc+0x988
04d3f9d4 77342ec5 user32!UserCallWinProcCheckWow+0x498
04d3fa50 77342a10 user32!DispatchMessageWorker+0x4a5
04d3fa5c 7bc3f5a1 user32!DispatchMessageW+0x10
04d3fa80 7bc3f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
04d3fae0 7bc4196f CfgRelayEx!CConfigCenterStub::Process+0xa7
04d3faec 7bc5ffcb CfgRelayEx!CThread::ThreadProc+0x1f
04d3fb28 76e57ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04d3fb38 7780c11b kernel32!BaseThreadInitThunk+0x19
04d3fb90 7780c09f ntdll!__RtlUserThreadStart+0x2b
04d3fba0 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
002df978 7757e0c3 ntdll!RtlpLowFragHeapFree+0xc5
002df990 765114bd ntdll!RtlFreeHeap+0x105
002df9a4 0f3bac02 kernel32!HeapFree+0x14
002df9c0 0f3babd2 CfgRelayEx!ATL::CWin32Heap::Free+0x22
002df9d0 0f3dab0a CfgRelayEx!ATL::CAtlStringMgr::Free+0x22
002df9e8 0f3daaed CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x3a
002dfa00 0f3daaed CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x1d
002dfa18 0f3daaed CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x1d
002dfa30 0f3daaed CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x1d
002dfa48 0f3daaed CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x1d
002dfa60 0f3f4f13 CfgRelayEx!std::_Tree<std::_Tmap_traits<enum CommonProductType,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >,std::less<enum CommonProductType>,std::allocator<std::pair<enum CommonProductType const ,ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > > > >,0> >::_Erase+0x1d
002dfa84 0f3e0f53 CfgRelayEx!ATL::`dynamic atexit destructor for '_AtlBaseModule''+0x4d9
002dfab0 0f3e0e31 CfgRelayEx!<lambda_275893d493268fdec8709772e3fcec0e>::operator()+0x89
002dfae4 0f3e0e7f CfgRelayEx!__crt_seh_guarded_call<int>::operator()<<lambda_995298e7d72eb4c2aab26c0585b3abe5>,<lambda_275893d493268fdec8709772e3fcec0e> &,<lambda_293819299cbf9a7022e18b56a874bb5c> >+0x27
002dfb04 0f3e1158 CfgRelayEx!__acrt_lock_and_call<<lambda_275893d493268fdec8709772e3fcec0e> >+0x24
002dfb18 0f3e0714 CfgRelayEx!_execute_onexit_table+0x17
002dfb50 0f3e0895 CfgRelayEx!common_exit+0xa1
002dfb60 0f3c92d7 CfgRelayEx!_cexit+0xb
002dfb94 0f3c918f CfgRelayEx!dllmain_crt_process_detach+0x39
002dfba0 0f3c93df CfgRelayEx!dllmain_crt_dispatch+0x4e
002dfbe0 0f3c947d CfgRelayEx!dllmain_dispatch+0xaf
002dfbf4 77589264 CfgRelayEx!_DllMainCRTStartup+0x1c
002dfc14 775a8fa8 ntdll!LdrpCallInitRoutine+0x14
002dfcb8 775a8e4a ntdll!LdrShutdownProcess+0x1aa
002dfccc 76517a3c ntdll!RtlExitUserProcess+0x74
002dfce0 0130275a kernel32!ExitProcessStub+0x12
002dfcec 013026ef srvhost!exit_or_terminate_process+0x40
002dfd24 01302895 srvhost!common_exit+0xee
002dfd38 012f7e90 srvhost!exit+0x11
002dfd78 7651344d srvhost!__scrt_common_main_seh+0x179
002dfd84 77589802 kernel32!BaseThreadInitThunk+0xe
002dfdc4 775897d5 ntdll!__RtlUserThreadStart+0x70
002dfddc 00000000 ntdll!_RtlUserThreadStart+0x1b