Crash with CoreLocation

Hello,

I'm getting crashes in an enterprise app affecting thousands. I have so far been unable to reproduce it locally.
See the crash report below, but looking through many crash reports, I can't see a lot of correlation with what is going on with the other threads that would trigger this.

This seems to be related to https://developer.apple.com/forums/thread/655243, but I'm not sure. We have confirmed that the crash only happens on iOS 12.X and below (it does not happen in iOS 14)

I would appreciate any advice how I might investigate further.

Code Block
Incident Identifier: 7A45EC93-6474-49B5-9F02-9768C2A1DD93
CrashReporter Key: TODO
Hardware Model: iPhone7,1
Process: MyApp [2544]
Path: /var/containers/Bundle/Application/A5B70A01-157A-410D-8114-2101D36E7EED/MyApp.app/MyApp
Identifier: <my_identifier>
Version: 6387
Code Type: ARM-64
Parent Process: [1]
Date/Time: 2020-11-18 17:01:49 +0000
OS Version: iPhone OS 12.4.8 (16G201)
Report Version: 104
Exception Type: SIGSEGV
Exception Codes: SEGV_MAPERR at 0x282b0
Crashed Thread: 0
Thread 0 Crashed:
0 libsystem_platform.dylib 0x00000001ab977384 _platform_strlen + 4
1 CoreLocation 0x00000001b2b103c8 0x1b2b08000 + 33736
2 CoreLocation 0x00000001b2b22b68 0x1b2b08000 + 109416
3 CoreLocation 0x00000001b2b21414 0x1b2b08000 + 103444
4 CoreLocation 0x00000001b2b0b854 0x1b2b08000 + 14420
5 CoreFoundation 0x00000001abcf8d6c 0x1abc4e000 + 699756
6 CoreFoundation 0x00000001abcf8670 0x1abc4e000 + 697968
7 CoreFoundation 0x00000001abcf36b0 0x1abc4e000 + 677552
8 CoreFoundation 0x00000001abcf2fb4 0x1abc4e000 + 675764
9 GraphicsServices 0x00000001adef479c GSEventRunModal + 104
10 UIKitCore 0x00000001d8554c38 UIApplicationMain + 212
11 MyApp 0x0000000101384534 main (<compiler-generated>:0)
12 libdyld.dylib 0x00000001ab7b68e0 start + 4
Thread 0 crashed with ARM-64 Thread State:
pc: 0x00000001ab977384 fp: 0x000000016ea81560 sp: 0x000000016ea81520 x0: 0x00000000000282b7
x1: 0x00000000000282b0 x2: 0x00000000000b0000 x3: 0x0000000000000000 x4: 0x000000016ea82320
x5: 0x000000016ea82520 x6: 0x0000000000000000 x7: 0x0000000000000403 x8: 0x551a815a96fb002e
x9: 0x0000000000000008 x10: 0x0000000000000038 x11: 0x00000000000007fb x12: 0x00000000000007fd
x13: 0x0000000000000000 x14: 0x000000004760e800 x15: 0x000000000000001d x16: 0x00000001ab977380
x17: 0x0000000047600000 x18: 0x0000000000000000 x19: 0x0000000000000000 x20: 0x000000016ea82320
x21: 0x00000000000282b7 x22: 0x00000000000b0000 x23: 0x0000000000000004 x24: 0x0000000000000001
x25: 0x00000001bf04e033 x26: 0x0000000280629590 x27: 0x00000001e34ae000 x28: 0x000000028389b000
lr: 0x00000001b2b2e7a8 cpsr: 0x0000000060000000

I found a better example with Symbolicated values.
Here's the thread that crashed:
Code Block
Thread 0 Crashed:
0 libsystem_c.dylib 0x000000018440e38c strlen + 12
1 CoreLocation 0x000000018b226cc4 CLCommonEnTrHashReduceInjest + 60 (CLCommon.mm:2023)
2 CoreLocation 0x000000018b209068 CLClientTraceDelegateMonitorCallback + 52 (CLClient.mm:2624)
3 CoreLocation 0x000000018b21b57c -[CLLocationManager onClientEventRegion:] + 1500 (CLLocationManager.m:2141)
4 CoreLocation 0x000000018b219f70 -[CLLocationManager onClientEvent:supportInfo:] + 1064 (CLLocationManager.m:0)
5 CoreLocation 0x000000018b2039e8 invocation function for block in CLClientInvokeCallback(CLClient*, CLClientEvent, objc_object*) + 140 (CLClient.mm:745)
6 CoreFoundation 0x0000000184a232bc CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK + 20 (CFRunLoop.c:1840)
7 CoreFoundation 0x0000000184a22a7c CFRunLoopDoBlocks + 264 (CFRunLoop.c:1881)
8 CoreFoundation 0x0000000184a20abc __CFRunLoopRun + 2004 (CFRunLoop.c:3176)
9 CoreFoundation 0x0000000184940da8 CFRunLoopRunSpecific + 552 (CFRunLoop.c:3245)
10 GraphicsServices 0x0000000186926020 GSEventRunModal + 100 (GSEvent.c:2245)
11 UIKit 0x000000018e960758 UIApplicationMain + 236 (UIApplication.m:3965)
12 MyApp 0x0000000104e9c534 0x104e94000 + 34100
13 libdyld.dylib 0x00000001843d1fc0 start + 4

Here's some more info of the 2nd crash I listed in my comment:
Code Block
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x5d5cc0004c297280
VM Region Info: 0x5d5cc0004c297280 is not in any region. Bytes after previous region: 6727463042841932417
REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL
MALLOC_NANO (reserved) 00000001d8000000-00000001e0000000 [128.0M] rw-/rwx SM=NUL ...(unallocated)
--->
UNUSED SPACE AT END

Crash with CoreLocation
 
 
Q