iOS 16.1 UIKit crashes

Hi, we are observing random crashes related to the UIKit in areas that haven't been modified for some time but were heavily used by the users. Those crashes are occurring on devices with iOS 16.1 and higher only. The crashes usually happen during UIView/UIViewController lifecycle methods, where some of them point to NSLayoutConstraint lifecycle.

Example stack traces (redacted):

Exception Type:  SIGSEGV
Exception Codes: SEGV_MAPERR at 0xffffffff
Crashed Thread:  0

Thread 0 Crashed:
0   libobjc.A.dylib                      0x00000001d0dd3074 objc_retain_x8 + 8
1   UIKitCore                            0x00000001d9c7fd44 -[UIView(Internal) _addSubview:positioned:relativeTo:] + 2528
Frames 2-5 UIViewController lifecycle methods (redacted)
6   UIKitCore                            0x00000001d9fe3dc4 -[UIViewController _sendViewDidLoadWithAppearanceProxyObjectTaggingEnabled] + 80
7   UIKitCore                            0x00000001d9c7be40 -[UIViewController loadViewIfRequired] + 708
8   UIKitCore                            0x00000001d9c7bb58 -[UIViewController view] + 20
9   UIKitCore                            0x00000001d9f41f04 -[UINavigationController _startCustomTransition:] + 888
10  UIKitCore                            0x00000001d9e07f44 -[UINavigationController _startDeferredTransitionIfNeeded:] + 492
11  UIKitCore                            0x00000001d9e07604 -[UINavigationController __viewWillLayoutSubviews] + 92
12  UIKitCore                            0x00000001d9e07568 -[UILayoutContainerView layoutSubviews] + 168
13  UIKitCore                            0x00000001d9c66020 -[UIView(CALayerDelegate) layoutSublayersOfLayer:] + 1976
14  QuartzCore                           0x00000001d913b9ec CA::Layer::layout_if_needed(CA::Transaction*) + 496
15  QuartzCore                           0x00000001d914f0a0 CA::Layer::layout_and_display_if_needed(CA::Transaction*) + 144
16  QuartzCore                           0x00000001d91605b0 CA::Context::commit_transaction(CA::Transaction*, double, double*) + 452
17  QuartzCore                           0x00000001d91955ec CA::Transaction::commit() + 648
18  QuartzCore                           0x00000001d917e8cc CA::Transaction::flush_as_runloop_observer(bool) + 84
19  CoreFoundation                       0x00000001d7b35d60 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 32
20  CoreFoundation                       0x00000001d7abe2d0 __CFRunLoopDoObservers + 528
21  CoreFoundation                       0x00000001d7b1fc7c __CFRunLoopRun + 1044
22  CoreFoundation                       0x00000001d7b24ed4 __CFStreamDeallocate + 132
23  GraphicsServices                     0x0000000210e22368 GSEventRunModal + 160
24  UIKitCore                            0x00000001da0033d0 -[UIApplication _run] + 884
25  UIKitCore                            0x00000001da003034 UIApplicationMain + 336
26  (redacted)                      0x0000000102a3fc9c main (main.m:19)
27  ???                                  0x00000001f618c960 0x0 + 0
Thread 0 Crashed:
libobjc.A.dylib objc_retain
UIKitCore -[UIView(AdditionalLayoutSupport) _startObservingVariablesOnlyToSupportTAMICChange:]
UIKitCore -[UIView(AdditionalLayoutSupport) setTranslatesAutoresizingMaskIntoConstraints:]
Exception Type:  SIGSEGV
Exception Codes: SEGV_MAPERR at 0x0
Crashed Thread:  0

Thread 0 Crashed:
0   CoreAutoLayout                       0x00000001bdfc5e80 _table_addStorageBlock + 328
1   CoreAutoLayout                       0x00000001bdfbfe94 -[NSISEngine init] + 168
2   UIKitCore                            0x00000001a3aa0a80 -[UIView(AdditionalLayoutSupport) _initializeHostedLayoutEngine] + 80
3   UIKitCore                            0x00000001a390a970 -[UIView(AdditionalLayoutSupport) _layoutEngineCreateIfNecessary] + 44
4   UIKitCore                            0x00000001a3924624 -[UIView _tryToAddConstraint:roundingAdjustment:mutuallyExclusiveConstraints:] + 92
5   UIKitCore                            0x00000001a39425b0 -[UIView(UIConstraintBasedLayout) nsli_addConstraint:] + 72
6   CoreAutoLayout                       0x00000001bdfb8b0c +[NSLayoutConstraint _addOrRemoveConstraints:activate:] + 336
7   UIKitCore                            0x00000001a3a1bc88 -[UIView safeAreaLayoutGuide] + 564

Most crashes occur on

Thread 0 Crashed:
0   libobjc.A.dylib                      0x00000001c447b074 objc_retain_x8 + 8
1   UIKitCore                            0x00000001cd333d44 -[UIView(Internal) _addSubview:positioned:relativeTo:] + 2528
iOS 16.1 UIKit crashes
 
 
Q