Crash in cfgrelayex, Analyzed 3 dumps, total processed 154, rate equals 1.95%

Top 1: Version = 2.7224.1000.620, Total count = 3

dump count = 1

ChildEBP RetAddr  
04a8e1cc 75f36cb7 gdi32full!bGetRealizationInfoInternal+0x15
04a8e200 75f64a63 gdi32full!GetFontRealizationInfo+0xd7
04a8e7b0 75f66f9f gdi32full!LoadFont+0x70
04a8e7d4 75f65a69 gdi32full!FindOrCreateFaceCache+0x98
04a8e8d8 75f39d6c gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
04a8ec78 75f3a196 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2ac
04a8ed84 75f3790b gdi32full!ScriptStringAnalyse+0x3e6
04a8eef4 75f37170 gdi32full!LpkCharsetDraw+0x53b
04a8ef20 752ec903 gdi32full!LpkDrawTextEx+0x30
04a8efa4 752ec2fd user32!DT_GetLineBreak+0x113
04a8f064 7530698e user32!DrawTextExWorker+0x1ed
04a8f080 6fa8ee89 user32!DrawTextExW+0x1e
04a8f51c 6fa8c349 uxtheme!CThemeWnd::GetNcWindowMetrics+0x809
04a8f668 752e70c3 uxtheme!_ThemeDefWindowProc+0x899
04a8f75c 752e6b2a user32!UserCallWinProcCheckWow+0x4d3
04a8f7c0 752f0217 user32!DispatchClientMessage+0xea
04a8f800 771f71dc user32!__fnINLPWINDOWPOS+0x37
04a8f850 7547129c ntdll!KiUserCallbackDispatcher+0x4c
04a8f854 6fabb77f win32u!NtUserSetWindowPos+0xc
04a8f880 6fa8dd73 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
04a8f8dc 752e706a uxtheme!ThemePreWndProc+0x413
04a8f9d0 752e59c8 user32!UserCallWinProcCheckWow+0x47a
04a8fa4c 752e5500 user32!DispatchMessageWorker+0x4b8
04a8fa58 7bd3f5a1 user32!DispatchMessageW+0x10
04a8fa7c 7bd3f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
04a8fadc 7bd4196f CfgRelayEx!CConfigCenterStub::Process+0xa7
04a8fae8 7bd5ffcb CfgRelayEx!CThread::ThreadProc+0x1f
04a8fb24 75e26839 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04a8fb34 771e906f kernel32!BaseThreadInitThunk+0x19
04a8fb8c 771e903d ntdll!__RtlUserThreadStart+0x2b
04a8fb9c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
03caf644 77ad627f ntdll!RtlpLfhFindClearBitAndSet+0x5b
03caf6d8 77ad5dde ntdll!RtlpAllocateHeapInternal+0x48f
03caf6f0 5c4ea12a ntdll!RtlAllocateHeap+0x3e
03caf708 5c4ea0c8 CfgRelayEx!ATL::CWin32Heap::Allocate+0x1a
03caf738 5c4eab33 CfgRelayEx!ATL::CAtlStringMgr::Allocate+0xd8
03caf764 5c4eb6a3 CfgRelayEx!ATL::CSimpleStringT<wchar_t,0>::Fork+0x43
03caf77c 5c4eb752 CfgRelayEx!ATL::CSimpleStringT<wchar_t,0>::PrepareWrite2+0x43
03caf798 5c4ead33 CfgRelayEx!ATL::CSimpleStringT<wchar_t,0>::PrepareWrite+0x52
03caf7a8 5c4ebeb5 CfgRelayEx!ATL::CSimpleStringT<wchar_t,0>::GetBuffer+0x13
03caf7c4 5c4ebe50 CfgRelayEx!ATL::CSimpleStringT<wchar_t,0>::SetString+0x55
03caf7d8 5c4e9823 CfgRelayEx!ATL::CSimpleStringT<wchar_t,0>::SetString+0x20
03caf7e8 5c4e9843 CfgRelayEx!ATL::CSimpleStringT<wchar_t,0>::operator=+0x13
03caf7f8 5c4e8f7a CfgRelayEx!ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >::operator=+0x13
03caf818 5c4eb549 CfgRelayEx!ATL::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,ATL::StrTraitATL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >+0x5a
03caf8a0 5c4eb472 CfgRelayEx!CClientMgr::OnSlowCfgRefresh+0xc9
03caf8b8 5c4f3390 CfgRelayEx!CClientMgr::OnReceiveMessage+0x42
03caf914 5c4f320f CfgRelayEx!CChannelImpl::ReceiveThreadImp+0x170
03caf91c 5c50ffcb CfgRelayEx!CChannelImpl::ReceiveThread+0xf
03caf958 75d0fa29 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03caf968 77af7a9e kernel32!BaseThreadInitThunk+0x19
03caf9c4 77af7a6e ntdll!__RtlUserThreadStart+0x2f
03caf9d4 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
043ae318 76d70ca4 gdi32full!GetFontRealizationInfo+0x15
043ae8c8 76d71806 gdi32full!LoadFont+0x76
043ae8ec 76d72029 gdi32full!FindOrCreateFaceCache+0x98
043ae9f0 76d793f4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
043aed98 76d777f6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
043af204 76d768ef gdi32full!ScriptStringAnalyse+0xa16
043af37c 76d76d18 gdi32full!LpkCharsetDraw+0x60f
043af448 76d7e6b2 gdi32full!GetTextMetricsW+0x108
043af47c 74f6ed8b gdi32full!IntersectClipRectImpl+0x42
043af54c 74f6eb8e user32!DrawTextExWorker+0x1f9
043af568 74b7e77a user32!DrawTextExW+0x1e
043af5cc 74b7de14 uxtheme!CTextDraw::GetTextExtent+0xa4
043af614 74b743e9 uxtheme!GetThemeTextExtent+0x74
043af668 74b81027 uxtheme!_GetNcCaptionTextSize+0x61
043af75c 74b829dc uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
043af808 74b82a8f uxtheme!_WindowPosChangedWorker+0x7c
043af814 74b7f5f5 uxtheme!OnOwpPostWindowPosChanged+0x1f
043af864 74f7a453 uxtheme!ThemePostWndProc+0x355
043af94c 74f7a02a user32!UserCallWinProcCheckWow+0x363
043af9b0 74f81467 user32!DispatchClientMessage+0xea
043af9f0 76fc4e9d user32!__fnINLPWINDOWPOS+0x37
043afa40 74b9de9f ntdll!KiUserCallbackDispatcher+0x4d
043afa6c 74b8018f uxtheme!OnOwpPreDwmCompositionChanged+0x4f
043afac8 74f7a3ff uxtheme!ThemePreWndProc+0x43f
043afbb0 74f7819a user32!UserCallWinProcCheckWow+0x30f
043afc24 74f77f60 user32!DispatchMessageWorker+0x22a
043afc30 5008f5a1 user32!DispatchMessageW+0x10
043afc54 5008f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
043afcb4 5009196f CfgRelayEx!CConfigCenterStub::Process+0xa7
043afcc0 500affcb CfgRelayEx!CThread::ThreadProc+0x1f
043afcfc 753ffa29 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
043afd0c 76fb7a9e kernel32!BaseThreadInitThunk+0x19
043afd68 76fb7a6e ntdll!__RtlUserThreadStart+0x2f
043afd78 00000000 ntdll!_RtlUserThreadStart+0x1b