Crash in cfgrelayex, Analyzed 2 dumps, total processed 124, rate equals 1.61%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
04fee120 7511433f gdi32full!GetFontRealizationInfo+0x1c
04fee6d0 7510a1bb gdi32full!LoadFont+0x70
04fee6f4 7510a312 gdi32full!FindOrCreateFaceCache+0xc7
04fee800 750a8ae5 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x128
04feeba8 750a94db gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2a5
04feecc4 750aa873 gdi32full!ScriptStringAnalyse+0x3eb
04feee60 750a8733 gdi32full!LpkCharsetDraw+0xa93
04feeea0 771ef11b gdi32full!LpkDrawTextEx+0x203
04feef04 771ef021 user32!DT_DrawStr+0x69
04feef5c 771eec1e user32!DT_GetLineBreak+0xf8
04fef02c 7725c76e user32!DrawTextExWorker+0x1c4
04fef048 65680f64 user32!DrawTextExW+0x1e
04fef0ac 65686f4a uxtheme!CTextDraw::GetTextExtent+0x109
04fef0f4 6567875d uxtheme!GetThemeTextExtent+0x8a
04fef148 656468ba uxtheme!_GetNcCaptionTextSize+0x61
04fef2c0 65647bfe uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
04fef3a4 6564c32f uxtheme!_WindowPosChangedWorker+0x73
04fef3b0 656490e0 uxtheme!OnOwpPostWindowPosChanged+0x1f
04fef418 771e4260 uxtheme!ThemePostWndProc+0x340
04fef514 771e3cb0 user32!UserCallWinProcCheckWow+0x4f0
04fef578 771f1027 user32!DispatchClientMessage+0x190
04fef5b8 773f932d user32!__fnINLPWINDOWPOS+0x37
04fef608 751912ac ntdll!KiUserCallbackDispatcher+0x4d
04fef60c 656769df win32u!NtUserSetWindowPos+0xc
04fef638 6564a478 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
04fef6b8 771e4208 uxtheme!ThemePreWndProc+0x988
04fef7b4 771e2a48 user32!UserCallWinProcCheckWow+0x498
04fef830 771e25b0 user32!DispatchMessageWorker+0x488
04fef83c 5321f5a1 user32!DispatchMessageW+0x10
04fef860 5321f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
04fef8c0 5322196f CfgRelayEx!CConfigCenterStub::Process+0xa7
04fef8cc 5323ffcb CfgRelayEx!CThread::ThreadProc+0x1f
04fef908 75b57ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04fef918 773ec28b kernel32!BaseThreadInitThunk+0x19
04fef970 773ec20f ntdll!__RtlUserThreadStart+0x2b
04fef980 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0357fba4 60d8345d ntdll!RtlInitUnicodeString+0x1b
0357fbec 60d83c0f CfgRelayEx!CChannelImpl::Run+0x3d
0357fbf4 60d9ffcb CfgRelayEx!CChannelImpl::ThreadImpl+0xf
0357fc30 7502343d CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0357fc3c 77399802 kernel32!BaseThreadInitThunk+0xe
0357fc7c 773997d5 ntdll!__RtlUserThreadStart+0x70
0357fc94 00000000 ntdll!_RtlUserThreadStart+0x1b