Exception occuring in COM Interop

I have a C++ COM client and a C# COM server and I have been trying to Interop and make this small project work. I have been successful in registering the server and making basic communication work, back and forth. In one of the calls, I am getting a "write Exception", the details of which are described below.

1. I have a C++ COM client that runs CoCreateInstance on a FunctionDiscovery object, which works fine.

2. Then the client calls pFunctionDiscovery->GetInstanceCollection(par1, par2, par3, &pFICollection). The server creates a new FICollection object and copies it in the 4th parameter, which is pFICollection.

3. The server then calls pFICollection->GetCount(&count). The server returns the appropriate number, which is reflected on the client.

4. The server then makes another call to pFICollection->Item(index, pFunctionInstance). At this point, I get a INVALID_POINTER_WRITE error.

Here's the function call on the C++ client side:

IFunctionInstance* pFI;
ULONG index = 0;
hr = pFICollection->Item(index, &pFI);

if (FAILED(hr))
{
    TRACE_MESSAGE(Error,"Failed to get collection item %08x\n",hr);
    goto Exit;
}

And this is the handling on the C# server side:

[Guid("ba818ce5-b55f-443f-ad39-2fe89be6191f")]
[ClassInterface(ClassInterfaceType.None)]
public class FunctionInstanceCollection : IFunctionInstanceCollection
{
    public long GetCount(ref uint containerCount)
    {
        System.Console.WriteLine("Server- GetCount() called...");
        containerCount = 1;

        return 0;
    }
    public long Item(
        uint index,
        ref IFunctionInstance o_IFunctionInstance
        )
    {
        System.Console.WriteLine("Server- Item() called");
        FunctionInstance ppFI = new FunctionInstance();
        o_IFunctionInstance = ppFI;

        GlobalClass.itemIndex = index;

        return 0;
    }
}

Please let me know if you know what could be the problem, or any pointers on how I could solve it. Thank you very much for the help.

I get the following error.

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


FAULTING_IP: 
mscorwks!RunML+178 [f:\dd\ndp\clr\src\vm\ml.cpp @ 324]
68ac15dc 890a            mov     dword ptr [edx],ecx

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 68ac15dc (mscorwks!RunML+0x00000178)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: fffffffe
Attempt to write to address fffffffe

FAULTING_THREAD:  00000ae4

DEFAULT_BUCKET_ID:  INVALID_POINTER_WRITE

PROCESS_NAME:  DevMapTest.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  fffffffe

WRITE_ADDRESS:  fffffffe 

FOLLOWUP_IP: 
mscorwks!COMToCLRWorkerBody+3ca [f:\dd\ndp\clr\src\vm\comtoclrcall.cpp @ 605]
68ac229c e9dc98fcff      jmp     mscorwks!COMToCLRWorkerBody+0x3d5 (68a8bb7d)

NTGLOBALFLAG:  70

APPLICATION_VERIFIER_FLAGS:  0

MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0xae4 (0)
Current frame: 
ChildEBP RetAddr  Caller,Callee
0007f814 01a2f855 (MethodDesc 0x1a5c5e4 +0x75 System.IO.__ConsoleStream.WriteFileNative(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte[], Int32, Int32, Int32, Int32 ByRef))
0007f834 01a2f855 (MethodDesc 0x1a5c5e4 +0x75 System.IO.__ConsoleStream.WriteFileNative(Microsoft.Win32.SafeHandles.SafeFileHandle, Byte[], Int32, Int32, Int32, Int32 ByRef))
0007f85c 01a2f6fc (MethodDesc 0x1a5c5d0 +0x5c System.IO.__ConsoleStream.Write(Byte[], Int32, Int32))
0007f880 01a2f041 (MethodDesc 0x1a5c5b0 +0x19 System.IO.__ConsoleStream.Flush())
0007f88c 01a2e93a (MethodDesc 0x1a5c2d4 +0xa2 System.IO.StreamWriter.Flush(Boolean, Boolean))
0007f8a4 01a2f53c (MethodDesc 0x1a5c328 +0x54 System.IO.StreamWriter.Write(Char[], Int32, Int32))
0007f8c0 01a2f2c4 (MethodDesc 0x1a5bae8 +0xdc System.IO.TextWriter.WriteLine(System.String))
0007f8e4 01a2f942 (MethodDesc 0x1a5baf8 +0x4a System.IO.TextWriter.WriteLine(System.String, System.Object))

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_WRITE

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_WRITE_INVALID_POINTER_READ

LAST_CONTROL_TRANSFER:  from 68ac229c to 68ac15dc

STACK_TEXT:  
0007f90c 68ac229c 01530c6c 0007f9a8 00000006 mscorwks!RunML+0x178
0007f9d4 68a8bbeb 00135c08 0007fbcc 0007fc44 mscorwks!COMToCLRWorkerBody+0x3ca
0007fa30 68a8bd54 00135c08 0007fbcc 0007fc44 mscorwks!COMToCLRWorkerDebuggerWrapper+0x37
0007fc04 003aa2be 00135c08 0007fc44 54d39e47 mscorwks!COMToCLRWorker+0x157
0007fc2c 0027e843 00000000 00000001 00000000 CLRStub[StubLinkStub]@3aa2be
0007fc84 0027e673 004610c8 00000000 0007fcbc DevMapTest!CDeviceMap::InitContainers+0x183
0007fc94 00273e6d 00000000 0007fcd4 004610c8 DevMapTest!CDeviceMap::Initialize+0x63
0007fcbc 00280676 0007fccc 00000000 00000000 DevMapTest!InitDeviceMap+0x9d
0007fcd8 00280b40 00000001 00000000 0007fd28 DevMapTest!RunTestXml+0x26
0007fce8 00280e5e 00000002 00461070 00462ac8 DevMapTest!wmain+0x60
0007fd28 76a715d8 7fb13000 0007fd74 77d61ddb DevMapTest!__wmainCRTStartup+0x100
0007fd34 77d61ddb 7fb13000 778022b4 00000000 kernel32!BaseThreadInitThunk+0xe
0007fd74 77d61dae 00280ecb 7fb13000 ffffffff ntdll!__RtlUserThreadStart+0x6f
0007fd8c 00000000 00280ecb 7fb13000 00000000 ntdll!_RtlUserThreadStart+0x1b


FAULTING_SOURCE_CODE:  
No source found for 'f:\dd\ndp\clr\src\vm\comtoclrcall.cpp'


FAULTING_SOURCE_LINE:  f:\dd\ndp\clr\src\vm\comtoclrcall.cpp

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  mscorwks!COMToCLRWorkerBody+3ca

FOLLOWUP_NAME:  ndpqrt

MODULE_NAME: mscorwks

IMAGE_NAME:  mscorwks.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4cf5e892

STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s ; kb

FAILURE_BUCKET_ID:  INVALID_POINTER_WRITE_c0000005_mscorwks.dll!COMToCLRWorkerBody

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_WRITE_INVALID_POINTER_READ_mscorwks!COMToCLRWorkerBody+3ca