Crash in cfgrelayex, Analyzed 3 dumps, total processed 116, rate equals 2.59%

Top 1: Version = 2.7224.1000.620, Total count = 3

dump count = 2

ChildEBP RetAddr  
0521e060 75a85d29 gdi32full!pcfLocateCFONT+0x6d
0521e3e0 75af1f6f gdi32full!GetFontRealizationInfo+0x109
0521e990 75ae7e0b gdi32full!LoadFont+0x70
0521e9b4 75ae7f62 gdi32full!FindOrCreateFaceCache+0xc7
0521eac0 75a86ad5 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x128
0521ee68 75a874cb gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2a5
0521ef84 75a88863 gdi32full!ScriptStringAnalyse+0x3eb
0521f128 75a86723 gdi32full!LpkCharsetDraw+0xa93
0521f168 74f6f57b gdi32full!LpkDrawTextEx+0x203
0521f1cc 74f6f481 user32!DT_DrawStr+0x69
0521f224 74f6f07e user32!DT_GetLineBreak+0xf8
0521f2f4 74fdcb2e user32!DrawTextExWorker+0x1c4
0521f310 66c809c4 user32!DrawTextExW+0x1e
0521f374 66c869aa uxtheme!CTextDraw::GetTextExtent+0x109
0521f3bc 66c781bd uxtheme!GetThemeTextExtent+0x8a
0521f410 66c4689a uxtheme!_GetNcCaptionTextSize+0x61
0521f588 66c47bde uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
0521f66c 66c4c30f uxtheme!_WindowPosChangedWorker+0x73
0521f678 66c490c0 uxtheme!OnOwpPostWindowPosChanged+0x1f
0521f6e0 74f64630 uxtheme!ThemePostWndProc+0x340
0521f7dc 74f6408a user32!UserCallWinProcCheckWow+0x4f0
0521f840 74f71487 user32!DispatchClientMessage+0xea
0521f880 76fb91bd user32!__fnINLPWINDOWPOS+0x37
0521f8d0 74df12ac ntdll!KiUserCallbackDispatcher+0x4d
0521f8d4 66c7643f win32u!NtUserSetWindowPos+0xc
0521f900 66c4a458 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0521f984 74f645d8 uxtheme!ThemePreWndProc+0x988
0521fa80 74f62ec5 user32!UserCallWinProcCheckWow+0x498
0521fafc 74f62a10 user32!DispatchMessageWorker+0x4a5
0521fb08 797ff5a1 user32!DispatchMessageW+0x10
0521fb2c 797ff2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0521fb8c 7980196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0521fb98 7981ffcb CfgRelayEx!CThread::ThreadProc+0x1f
0521fbd4 76737ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0521fbe4 76fac11b kernel32!BaseThreadInitThunk+0x19
0521fc3c 76fac09f ntdll!__RtlUserThreadStart+0x2b
0521fc4c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0594ee24 00000000 CfgRelayEx!CClientMgr::RegClient+0x5c