Crash in cfgrelayex, Analyzed 2 dumps, total processed 284, rate equals 0.70%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
0492e050 7711c63e ntdll!RtlpAllocateHeapInternal+0x8
0492e06c 76caf6d8 ntdll!RtlAllocateHeap+0x3e
0492e08c 76cb1da7 ucrtbase!_malloc_base+0x28
0492e0c4 750e1f14 ucrtbase!__crt_state_management::wrapped_invoke<void * (__cdecl*)(unsigned int),unsigned int,void *>+0x57
0492e0d0 750ea295 gdi32full!operator new+0x1c
0492e0ec 750eabd1 gdi32full!CFontHead::CFontHead+0x19
0492e154 750e946c gdi32full!InsertCFontCache+0x1e
0492e1c8 750dcb60 gdi32full!plfCreateLOCALFONT+0xf2
0492e38c 751410a6 gdi32full!CreateFontIndirectWImpl+0xc0
0492e488 75141a38 gdi32full!CacheFontLinkingData+0x233
0492e4a8 75141dcd gdi32full!IsFontRegLinked+0x28
0492ea50 75137a2b gdi32full!LoadFont+0x29e
0492ea74 75137b82 gdi32full!FindOrCreateFaceCache+0xc7
0492eb80 750d6aa5 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x128
0492ef28 750d749b gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2a5
0492f044 750d8833 gdi32full!ScriptStringAnalyse+0x3eb
0492f1c0 750d66f3 gdi32full!LpkCharsetDraw+0xa93
0492f200 76dceedb gdi32full!LpkDrawTextEx+0x203
0492f264 76dcede1 user32!DT_DrawStr+0x69
0492f2bc 76dce9de user32!DT_GetLineBreak+0xf8
0492f38c 76e3c5fe user32!DrawTextExWorker+0x1c4
0492f3a8 68c61014 user32!DrawTextExW+0x1e
0492f40c 68c66ffa uxtheme!CTextDraw::GetTextExtent+0x109
0492f454 68c5880d uxtheme!GetThemeTextExtent+0x8a
0492f4a8 68c268ba uxtheme!_GetNcCaptionTextSize+0x61
0492f620 68c27bfe uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
0492f704 68c2c32f uxtheme!_WindowPosChangedWorker+0x73
0492f710 68c290e0 uxtheme!OnOwpPostWindowPosChanged+0x1f
0492f778 76dc3f80 uxtheme!ThemePostWndProc+0x340
0492f874 76dc39da user32!UserCallWinProcCheckWow+0x4f0
0492f8d8 76dd0de7 user32!DispatchClientMessage+0xea
0492f918 7714916d user32!__fnINLPWINDOWPOS+0x37
0492f968 74e112ac ntdll!KiUserCallbackDispatcher+0x4d
0492f96c 68c56a8f win32u!NtUserSetWindowPos+0xc
0492f998 68c2a478 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0492fa18 76dc3f28 uxtheme!ThemePreWndProc+0x988
0492fb14 76dc2815 user32!UserCallWinProcCheckWow+0x498
0492fb90 76dc2360 user32!DispatchMessageWorker+0x4a5
0492fb9c 5030f5a1 user32!DispatchMessageW+0x10
0492fbc0 5030f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0492fc20 5031196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0492fc2c 5032ffcb CfgRelayEx!CThread::ThreadProc+0x1f
0492fc68 75cc7ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0492fc78 7713c0cb kernel32!BaseThreadInitThunk+0x19
0492fcd0 7713c04f ntdll!__RtlUserThreadStart+0x2b
0492fce0 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0466e4e8 74775424 gdi32full!LoadFont+0x15
0466e50c 74775812 gdi32full!FindOrCreateFaceCache+0x98
0466e610 7477c284 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
0466e9b8 7477a67a gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
0466eac4 74779171 gdi32full!ScriptStringAnalyse+0x76a
0466ec3c 76a9f04c gdi32full!LpkCharsetDraw+0x611
0466ec7c 747789a0 gdi32!_imp__GetLayout
0466eca8 74ce1a02 gdi32full!LpkDrawTextEx+0x30
0466ed34 74ce13fd user32!DT_GetLineBreak+0x122
0466edf4 74ce11fe user32!DrawTextExWorker+0x1ed
0466ee10 73f6480c user32!DrawTextExW+0x1e
0466f260 73f66f4b uxtheme!CThemeWnd::GetNcWindowMetrics+0x87c
0466f30c 73f66fdf uxtheme!_WindowPosChangedWorker+0x77
0466f318 73f63686 uxtheme!OnOwpPostWindowPosChanged+0x1f
0466f36c 74ce7353 uxtheme!ThemePostWndProc+0x406
0466f454 74ce6e3a user32!UserCallWinProcCheckWow+0x463
0466f4b8 74cf4017 user32!DispatchClientMessage+0xea
0466f4f8 76fb28ed user32!__fnINLPWINDOWPOS+0x37
0466f548 75b72d6c ntdll!KiUserCallbackDispatcher+0x4d
0466f54c 73f8419f win32u!NtUserSetWindowPos+0xc
0466f578 73f63d7e uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0466f5d4 74ce7326 uxtheme!ThemePreWndProc+0x60e
0466f6bc 74ce63db user32!UserCallWinProcCheckWow+0x436
0466f730 74ce61b0 user32!DispatchMessageWorker+0x21b
0466f73c 60e8f5a1 user32!DispatchMessageW+0x10
0466f760 60e8f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0466f7c0 60e9196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0466f7cc 60eaffcb CfgRelayEx!CThread::ThreadProc+0x1f
0466f808 74610179 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0466f818 76fa662d kernel32!BaseThreadInitThunk+0x19
0466f874 76fa65fd ntdll!__RtlUserThreadStart+0x2f
0466f884 00000000 ntdll!_RtlUserThreadStart+0x1b