Crash in cfgrelayex, Analyzed 4 dumps, total processed 190, rate equals 2.11%

Top 1: Version = 2.7224.1000.620, Total count = 4

dump count = 2

ChildEBP RetAddr  
03a5f8ac 7c0c345d ntdll!RtlInitUnicodeString+0x1b
03a5f8f4 7c0c3c0f CfgRelayEx!CChannelImpl::Run+0x3d
03a5f8fc 7c0dffcb CfgRelayEx!CChannelImpl::ThreadImpl+0xf
03a5f938 77116359 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03a5f948 775b7b74 kernel32!BaseThreadInitThunk+0x19
03a5f9a4 775b7b44 ntdll!__RtlUserThreadStart+0x2f
03a5f9b4 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0418e018 76ab5ffc gdi32full!pcfLocateCFONT+0x8
0418e398 76ab0ca4 gdi32full!GetFontRealizationInfo+0xdc
0418e948 76ab1806 gdi32full!LoadFont+0x76
0418e96c 76ab2029 gdi32full!FindOrCreateFaceCache+0x98
0418ea70 76ab93f4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
0418ee18 76ab77f6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
0418f284 76ab68ef gdi32full!ScriptStringAnalyse+0xa16
0418f41c 76ab6140 gdi32full!LpkCharsetDraw+0x60f
0418f448 7706adfd gdi32full!LpkDrawTextEx+0x30
0418f4a4 7706ac94 user32!DT_DrawStr+0x5f
0418f504 7706a7cb user32!DT_GetLineBreak+0xa2
0418f5d4 7706a5ce user32!DrawTextExWorker+0x1f9
0418f5f0 59e4e77a user32!DrawTextExW+0x1e
0418f654 59e4de14 uxtheme!CTextDraw::GetTextExtent+0xa4
0418f69c 59e443e9 uxtheme!GetThemeTextExtent+0x74
0418f6f0 59e51027 uxtheme!_GetNcCaptionTextSize+0x61
0418f7e4 59e529dc uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
0418f890 59e52a8f uxtheme!_WindowPosChangedWorker+0x7c
0418f89c 59e4f5f5 uxtheme!OnOwpPostWindowPosChanged+0x1f
0418f8ec 77075ea3 uxtheme!ThemePostWndProc+0x355
0418f9d4 77075a7a user32!UserCallWinProcCheckWow+0x363
0418fa38 7707ce97 user32!DispatchClientMessage+0xea
0418fa78 77694e7d user32!__fnINLPWINDOWPOS+0x37
0418fac8 59e6dc7f ntdll!KiUserCallbackDispatcher+0x4d
0418faf4 59e5018f uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0418fb50 77075e4f uxtheme!ThemePreWndProc+0x43f
0418fc38 77073bea user32!UserCallWinProcCheckWow+0x30f
0418fcac 770739b0 user32!DispatchMessageWorker+0x22a
0418fcb8 5080f5a1 user32!DispatchMessageW+0x10
0418fcdc 5080f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0418fd3c 5081196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0418fd48 5082ffcb CfgRelayEx!CThread::ThreadProc+0x1f
0418fd84 7553fa29 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0418fd94 77687a7e kernel32!BaseThreadInitThunk+0x19
0418fdf0 77687a4e ntdll!__RtlUserThreadStart+0x2f
0418fe00 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
04ebe1a0 771f1f6f gdi32full!GetFontRealizationInfo+0x1c
04ebe750 771e7e0b gdi32full!LoadFont+0x70
04ebe774 771e7f62 gdi32full!FindOrCreateFaceCache+0xc7
04ebe880 77186ad5 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x128
04ebec28 771874cb gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2a5
04ebed44 77188863 gdi32full!ScriptStringAnalyse+0x3eb
04ebeec0 77186723 gdi32full!LpkCharsetDraw+0xa93
04ebef00 7574f57b gdi32full!LpkDrawTextEx+0x203
04ebef64 7574f481 user32!DT_DrawStr+0x69
04ebefbc 7574f07e user32!DT_GetLineBreak+0xf8
04ebf08c 757bcb2e user32!DrawTextExWorker+0x1c4
04ebf0a8 714c09c4 user32!DrawTextExW+0x1e
04ebf10c 714c69aa uxtheme!CTextDraw::GetTextExtent+0x109
04ebf154 714b81bd uxtheme!GetThemeTextExtent+0x8a
04ebf1a8 7148689a uxtheme!_GetNcCaptionTextSize+0x61
04ebf320 71487bde uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
04ebf404 7148c30f uxtheme!_WindowPosChangedWorker+0x73
04ebf410 714890c0 uxtheme!OnOwpPostWindowPosChanged+0x1f
04ebf478 75744630 uxtheme!ThemePostWndProc+0x340
04ebf574 7574408a user32!UserCallWinProcCheckWow+0x4f0
04ebf5d8 75751487 user32!DispatchClientMessage+0xea
04ebf618 772e91bd user32!__fnINLPWINDOWPOS+0x37
04ebf668 76e412ac ntdll!KiUserCallbackDispatcher+0x4d
04ebf66c 714b643f win32u!NtUserSetWindowPos+0xc
04ebf698 7148a458 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
04ebf718 757445d8 uxtheme!ThemePreWndProc+0x988
04ebf814 75742ec5 user32!UserCallWinProcCheckWow+0x498
04ebf890 75742a10 user32!DispatchMessageWorker+0x4a5
04ebf89c 77ebf5a1 user32!DispatchMessageW+0x10
04ebf8c0 77ebf2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
04ebf920 77ec196f CfgRelayEx!CConfigCenterStub::Process+0xa7
04ebf92c 77edffcb CfgRelayEx!CThread::ThreadProc+0x1f
04ebf968 76c57ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04ebf978 772dc11b kernel32!BaseThreadInitThunk+0x19
04ebf9d0 772dc09f ntdll!__RtlUserThreadStart+0x2b
04ebf9e0 00000000 ntdll!_RtlUserThreadStart+0x1b