c# - PowerShell Crashes On NavigateComplete2 Event Firing -

i've been trying handle ie events shdocvw.internet explorer. added reference c:\windows\system32\shdocvw.dll in visual studio project, when compiled automatically generated interop.shdocvw.dll

i unable initialize shdocvw.internetexplorer directly in powershell, more info on issue here

powershell version info

ps c:\users\chentiangemalc> $psversiontable  name                           value ----                           ----- psversion                      5.1.14393.103 psedition                      desktop pscompatibleversions           {1.0, 2.0, 3.0, 4.0...} buildversion                   10.0.14393.103 clrversion                     4.0.30319.42000 wsmanstackversion              3.0 psremotingprotocolversion      2.3 serializationversion           1.1.0.1 

current code i'm using

[system.reflection.assembly]::loadfrom("c:\support\ieautomator\interop.shdocvw.dll")  $code = @' using system; using system.collections.generic; using system.text;  public static class ie {     public static shdocvw.internetexplorer getie()     {         var target = new shdocvw.internetexplorer();         return target;     } }  '@  add-type -typedefinition $code -referencedassemblies "c:\support\ieautomator\interop.shdocvw.dll" $ie = [ie]::getie() $navigatecomplete2 = register-objectevent -inputobject $ie -eventname "navigatecomplete2" -sourceidentifier "ie.navigatecomplete2" $ie.visible = $true $ie.navigate("http://www.google.com.au") wait-event -sourceidentifier "ie.navigatecomplete2" 

crash seems occur after google.com.au has loaded, when expect navigatecomplete2 event firing.

i tried

$ie.add_navigatecomplete2({ write-host "navigatecomplete2!" }) 

but did not trigger @ all. run under windbg :

1:006> !analyze -v ******************************************************************************* *                                                                             * *                        exception analysis                                   * *                                                                             * *******************************************************************************  *** warning: unable verify checksum c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\82473b57141194bcb8c2b3e31479e32d\microsoft.powershell.consolehost.ni.dll *** warning: unable verify checksum c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.p521220ea#\179a8ea61a118e0c51c9acc481b8fb86\microsoft.powershell.commands.utility.ni.dll failed switch target 0 geturlpagedata2 (winhttp) failed: 12002.  dump_class: 2  dump_qualifier: 0  faulting_ip:  clr!jit_isinstanceofclass2+1e 00007ff8`5bea3bae 488b5210        mov     rdx,qword ptr [rdx+10h]  exception_record:  (.exr -1) exceptionaddress: 00007ff85bea3bae (clr!jit_isinstanceofclass2+0x000000000000001e)    exceptioncode: c0000005 (access violation)   exceptionflags: 00000000 numberparameters: 2    parameter[0]: 0000000000000000    parameter[1]: ffffffffffffffff attempt read address ffffffffffffffff  faulting_thread:  00003f50  default_bucket_id:  invalid_pointer_read  process_name:  powershell.exe  error_code: (ntstatus) 0xc0000005 - instruction @ 0x%p referenced memory @ 0x%p. memory not %s.  exception_code: (ntstatus) 0xc0000005 - instruction @ 0x%p referenced memory @ 0x%p. memory not %s.  exception_code_str:  c0000005  exception_parameter1:  0000000000000000  exception_parameter2:  ffffffffffffffff  followup_ip:  clr!jit_isinstanceofclass2+1e 00007ff8`5bea3bae 488b5210        mov     rdx,qword ptr [rdx+10h]  read_address:  ffffffffffffffff   bugcheck_str:  invalid_pointer_read  watson_bkt_procstamp:  57899aad  watson_bkt_procver:  10.0.14393.0  process_ver_product:  microsoft® windows® operating system  watson_bkt_module:  clr.dll  watson_bkt_modstamp:  575a1507  watson_bkt_modoffset:  3bae  watson_bkt_modver:  4.6.1586.0  module_ver_product:  microsoft® .net framework  build_version_string:  10.0.14393.0 (rs1_release.160715-1616)  modlist_with_tschksum_hash:  0dd991ed9eff5611cdfb10e932a26711163d1273  modlist_sha1_hash:  cdcd900a67a9c62dc8ee8eebfc73dc865306c7d9  ntglobalflag:  70  application_verifier_flags:  0  product_type:  1  suite_mask:  272  missing_clr_symbol: 0  analysis_session_host:  desktop-nc2t50t  analysis_session_time:  09-13-2016 09:21:52.0518  analysis_version: 10.0.14321.1024 amd64fre  managed_code: 1  managed_engine_module:  clr  managed_analysis_provider:  sos  managed_thread_id: 3f50  thread_attributes:  os_locale:  ena  problem_classes:     invalid_pointer_read     tid    [0x3f50]     frame  [0x00]: clr!jit_isinstanceofclass2   last_control_transfer:  00007ff82fa2058e 00007ff85bea3bae  stack_text:   000000d2`42bfc148 00007ff8`2fa2058e : 00007ff8`5c5d48d8 00007ff8`5bfb47e6 0018029c`52a286b0 00007ff8`5bec4200 : clr!jit_isinstanceofclass2+0x1e 000000d2`42bfc150 00007ff8`2e4b9b01 : 00007ff7`fcaf8040 000000d2`42bfc300 000000d2`42bfc4b8 000000d2`42bfc3e8 : system_management_automation_ni+0x1e2058e 000000d2`42bfc1b0 00007ff7`fc8cb2fd : 000000d2`42bfc410 000000d2`42bfc4b8 000000d2`42bfc3e8 000000d2`42bfc8b0 : system_management_automation_ni+0x8b9b01 000000d2`42bfc240 00007ff8`5bea6a53 : 0000029c`54baf7b0 0000029c`54c5aee0 0000029c`54c6abf0 00007ff8`5c5b8948 : 0x00007ff7`fc8cb2fd 000000d2`42bfc290 00007ff8`5bea6913 : 00007ff8`593816b8 00000000`00000000 0000029c`54c6abf0 80003ffb`fe57e1e0 : clr!calldescrworkerinternal+0x83 000000d2`42bfc2d0 00007ff8`5bfecace : 00000000`00000000 00000000`00000000 000000d2`42bfc4b8 00007ff8`58d05352 : clr!calldescrworkerwithhandler+0x4e 000000d2`42bfc310 00007ff8`5bfec977 : 00007ff8`58d05352 00007ff8`59381c98 00000000`00000000 00007ff7`fcaf8040 : clr!calldescrworkerreflectionwrapper+0x1a 000000d2`42bfc360 00007ff8`59235230 : 000000d2`02000000 000000d2`42bfcb48 00000000`00000000 0000029c`54c5c800 : clr!runtimemethodhandle::invokemethod+0x567 000000d2`42bfc940 00007ff8`59234d32 : 0000029c`54764d68 00000000`00000000 00000000`00000000 000000d2`00000000 : mscorlib_ni+0x535230 000000d2`42bfc9b0 00007ff8`5bea6a53 : 0000029c`54c110c0 0000029c`54bb0018 00007ff8`00040100 0000029c`54764d68 : mscorlib_ni+0x534d32 000000d2`42bfca30 00007ff8`5bea6913 : 000000d2`42bfd248 00007ff8`5c06b8ac 000000d2`42bfd248 00000000`00000000 : clr!calldescrworkerinternal+0x83 000000d2`42bfca80 00007ff8`5bea7165 : 00000000`00000006 000000d2`42bfd5b0 000000d2`42bfdaa0 000000d2`42bfd248 : clr!calldescrworkerwithhandler+0x4e 000000d2`42bfcac0 00007ff8`5bfa3674 : 000000d2`42bfdb30 00000000`00040100 000000d2`42bfdb30 00000000`00040100 : clr!methoddesccallsite::calltargetworker+0xf8 000000d2`42bfcbd0 00007ff8`5bfa31d6 : 00007ff8`00000006 00000002`00000002 00002001`0000001d 000000d2`42bfd720 : clr!dispatchinfo::invokememberworker+0xad8 000000d2`42bfd780 00007ff8`5bfa3afd : 00000000`00000000 0000029c`6c89ab30 00000000`00000000 000000d2`42bfd9a0 : clr!dispatchinfo::invokememberdebuggerwrapper+0x1c6 000000d2`42bfd8e0 00007ff8`5bfa3ec6 : 0000029c`6cad8420 00000000`00000000 0000029c`542efe20 0000029c`6cabed30 : clr!dispatchinfo::invokemember+0x467 000000d2`42bfdbd0 00007ff8`5bfa3d2d : 0000029c`542efe00 0000029c`6cadbe8c 000000d2`42bfdd80 00000000`000000fc : clr!internaldispatchimpl_invoke+0x1ed 000000d2`42bfdcf0 00007ff8`5bfa3c6e : 0000029c`6cac1fa0 0000029c`6cad9888 00007ff8`00000000 00007ff8`00000000 : clr!internaldispatchimpl_invoke_callback+0xb2 000000d2`42bfdd50 00007ff8`6c785664 : 00000000`00000000 0000029c`6cadbf54 0000029c`6c89ab30 00007ff8`6c796db2 : clr!internaldispatchimpl_invoke_wrapper+0xf8 000000d2`42bfddf0 00007ff8`6c784840 : 000000d2`42bfe340 00007ff8`000000fc 000000d2`42bfe780 00000000`00000000 : oleaut32!idispatch_invoke_stub+0xd4 000000d2`42bfde80 00007ff8`6d4349f0 : 000000d2`42bfe050 000000d2`42bfe340 00007ff8`6c799ea2 000000d2`42bfe780 : oleaut32!idispatch_remoteinvoke_thunk+0x60 000000d2`42bfdef0 00007ff8`6d042260 : 00007ff8`6c796a10 0000029c`6cac4930 00000000`00000000 00007ff8`5c2b76e7 : rpcrt4!ndrstubcall2+0x990 000000d2`42bfe590 00007ff8`6c7747ce : 0000029c`00000001 000000d2`42bfe780 0000029c`6cac4908 0000029c`542efe00 : combase!cstdstubbuffer_invoke+0xb0 000000d2`42bfe5d0 00007ff8`6d08de2c : 00000000`00000000 0000029c`542efe20 000000d2`42bfe780 00000000`00000000 : oleaut32!cdispstubwrapper::invoke+0x11e 000000d2`42bfe620 00007ff8`6d08e472 : 0000029c`00000000 000000d2`42bfe790 000000d2`42bfe700 00007ff8`6d557ad7 : combase!objectmethodexceptionhandlingaction<<lambda_76d9e92c799d246a4afbe64a2bf5673d> >+0x4c 000000d2`42bfe680 00007ff8`6d0a5e18 : 0000029c`6cac1ad0 000000d2`42bfea20 0000029c`6cac48d0 0000029c`6ca45488 : combase!defaultstubinvoke+0x222 000000d2`42bfe8a0 00007ff8`6d0a3e1d : 00000000`00000000 00000000`00000000 0000007f`00000904 0000029c`6cac1a00 : combase!servercall::contextinvoke+0x448 000000d2`42bfeb80 00007ff8`6d0a2574 : 0000029c`6cac3d30 0000029c`6cac1720 0000029c`6cac1720 0000029c`fffffff4 : combase!appinvoke+0x32d 000000d2`42bfecf0 00007ff8`6d0a17fc : 0000029c`6cac18f0 0000029c`6cac1720 0000029c`52a10000 0000029c`6cac1720 : combase!cominvokewithlockandipid+0x574 000000d2`42bfef60 00007ff8`6d44a194 : 0000029c`52a10000 00000000`00000000 00007ff8`6d2138f0 00000000`00000000 : combase!threadinvoke+0xe2c 000000d2`42bff1a0 00007ff8`6d4490ad : 00000000`00000000 00000000`00000000 000000d2`42bff3c0 00007ff8`6a88e2eb : rpcrt4!dispatchtostubincnoavrf+0x24 000000d2`42bff1f0 00007ff8`6d449bfe : 0000029c`6cac3c74 000000d2`42bff3c0 00000060`00000000 00000000`00000000 : rpcrt4!rpc_interface::dispatchtostubworker+0x1bd 000000d2`42bff2c0 00007ff8`6d429927 : 0000029c`6cadbdc0 00000000`00000000 0000029c`6cac7db0 00000000`00000001 : rpcrt4!rpc_interface::dispatchtostubwithobject+0x15e 000000d2`42bff360 00007ff8`6d429f7c : 00000000`0660cbd5 0000029c`6cac3a70 000000d2`42bff509 0000029c`6cac3a70 : rpcrt4!lrpc_scall::dispatchrequest+0x177 000000d2`42bff440 00007ff8`6d44426c : 00000000`00000000 0000029c`6cac37a0 00000000`00000000 00000000`00000000 : rpcrt4!lrpc_scall::handlerequest+0x2bc 000000d2`42bff560 00007ff8`6d445acb : 0000029c`6c88c9e0 0000029c`6c88c9e0 0000029c`00000001 0000029c`6c88c9e0 : rpcrt4!lrpc_address::handlerequest+0x36c 000000d2`42bff610 00007ff8`6d4385ca : 00000000`00000001 000000d2`42bffab8 00000000`00000000 00007ff8`6d4e0f74 : rpcrt4!lrpc_address::processio+0x91b 000000d2`42bff750 00007ff8`6d5525fe : 00000000`00000000 00007ff8`00000001 00000000`7ffe03b0 00000000`00000000 : rpcrt4!lrpciocomplete+0xaa 000000d2`42bff7f0 00007ff8`6d5530d9 : 00000000`00000004 0000029c`6c88dc00 0000029c`6c893910 00000000`00000000 : ntdll!tppalpcpexecutecallback+0x25e 000000d2`42bff8a0 00007ff8`6cd98364 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!tppworkerthread+0x8d9 000000d2`42bffca0 00007ff8`6d585e91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!basethreadinitthunk+0x14 000000d2`42bffcd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!rtluserthreadstart+0x21   thread_sha1_hash_mod_func:  6f313d77ee52b1c452e91a9959f8da5f7c030dc7  thread_sha1_hash_mod_func_offset:  1362514c904581be6819c9ad457ddb0e0a348429  thread_sha1_hash_mod:  ef2aa043b63e07053dcc0140b8bae8887bda87e9  fault_instr_code:  10528b48  symbol_stack_index:  0  symbol_name:  clr!jit_isinstanceofclass2+1e  followup_name:  machineowner  module_name: clr  image_name:  clr.dll  debug_flr_image_timestamp:  575a1507  stack_command:  ~6s ; kb  bucket_id:  invalid_pointer_read_clr!jit_isinstanceofclass2+1e  primary_problem_class:  invalid_pointer_read_clr!jit_isinstanceofclass2+1e  failure_exception_code:  c0000005  failure_image_name:  clr.dll  bucket_id_image_str:  clr.dll  failure_module_name:  clr  bucket_id_module_str:  clr  failure_function_name:  jit_isinstanceofclass2  bucket_id_function_str:  jit_isinstanceofclass2  bucket_id_offset:  1e  bucket_id_modprivate: 1  bucket_id_modtimedatestamp:  575a1507  bucket_id_modchecksum:  9e00c2  bucket_id_modver_str:  4.6.1586.0  bucket_id_prefix_str:  invalid_pointer_read_  failure_problem_class:  invalid_pointer_read  failure_symbol_name:  clr.dll!jit_isinstanceofclass2  failure_bucket_id:  invalid_pointer_read_c0000005_clr.dll!jit_isinstanceofclass2  watson_stageone_url:  http://watson.microsoft.com/stageone/powershell.exe/10.0.14393.0/57899aad/clr.dll/4.6.1586.0/575a1507/c0000005/00003bae.htm?retriage=1  target_time:  2016-09-12t23:23:17.000z  osbuild:  14393  osservicepack:  0  servicepack_number: 0  os_revision: 0  osplatform_type:  x64  osname:  windows 10  osedition:  windows 10 winnt singleuserts  user_lcid:  0  osbuild_timestamp:  2016-07-16 12:21:29  builddatestamp_str:  160715-1616  buildlab_str:  rs1_release  buildosver_str:  10.0.14393.0  analysis_session_elapsed_time: 19ceb  analysis_source:  um  failure_id_hash_string:  um:invalid_pointer_read_c0000005_clr.dll!jit_isinstanceofclass2  failure_id_hash:  {8e51dedb-2c00-2e6e-4807-e20bf1dd21ab}  followup:     machineowner ---------  1:006> !clrstack os thread id: 0x3f50 (6)         child sp               ip call site 000000d242bfc4b8 00007ff85bea3bae [debuggeru2mcatchhandlerframe: 000000d242bfc4b8]  000000d242bfc7c8 00007ff85bea3bae [helpermethodframe_protectobj: 000000d242bfc7c8] system.runtimemethodhandle.invokemethod(system.object, system.object[], system.signature, boolean) 000000d242bfc940 00007ff859235230 system.reflection.runtimemethodinfo.unsafeinvokeinternal(system.object, system.object[], system.object[]) 000000d242bfc9b0 00007ff859234d32 system.reflection.runtimemethodinfo.invoke(system.object, system.reflection.bindingflags, system.reflection.binder, system.object[], system.globalization.cultureinfo) 000000d242bfdaa0 00007ff85bea6a53 [debuggeru2mcatchhandlerframe: 000000d242bfdaa0]  000000d242bfdaf0 00007ff85bea6a53 [gcframe: 000000d242bfdaf0]  000000d242bfdab8 00007ff85bea6a53 [gcframe: 000000d242bfdab8]  1:006> .foreach (ex {!dumpheap -type exception -short}){.echo "********************************";!pe ${ex} }  ******************************** exception object: 0000029c54761048 exception type:   system.exception message:          <none> innerexception:   <none> stacktrace (generated): <none> stacktracestring: <none> hresult: 80131500 ******************************** exception object: 0000029c547610e8 exception type:   system.outofmemoryexception message:          <none> innerexception:   <none> stacktrace (generated): <none> stacktracestring: <none> hresult: 8007000e ******************************** exception object: 0000029c54761188 exception type:   system.stackoverflowexception message:          <none> innerexception:   <none> stacktrace (generated): <none> stacktracestring: <none> hresult: 800703e9 ******************************** exception object: 0000029c54761228 exception type:   system.executionengineexception message:          <none> innerexception:   <none> stacktrace (generated): <none> stacktracestring: <none> hresult: 80131506 ******************************** exception object: 0000029c547612c8 exception type:   system.threading.threadabortexception message:          <none> innerexception:   <none> stacktrace (generated): <none> stacktracestring: <none> hresult: 80131530 ******************************** exception object: 0000029c54761368 exception type:   system.threading.threadabortexception message:          <none> innerexception:   <none> stacktrace (generated): <none> stacktracestring: <none> hresult: 80131530