During update from Service Mesh 1.0.10 to 1.1.0 within one of SMCP, new istio-pilot crashed with the following trace:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x17d7e14]

goroutine 1852 [running]:
istio.io/istio/pilot/pkg/networking/core/v1alpha3.isFallthroughFilterChain(...)
istio.io/istio@/pilot/pkg/networking/core/v1alpha3/listener.go:2247
istio.io/istio/pilot/pkg/networking/core/v1alpha3.mergeTCPFilterChains(0xc000ca4e10, 0x2, 0x2, 0xc0000afab0, 0xc000d08670, 0xc, 0xc00192b308, 0xc0007ae000, 0x0, 0x0, ...)
istio.io/istio@/pilot/pkg/networking/core/v1alpha3/listener.go:2083 +0x634
istio.io/istio/pilot/pkg/networking/core/v1alpha3.(*ConfigGeneratorImpl).buildSidecarOutboundListenerForPortOrUDS(0xc00046ddc0, 0xc0007ae000, 0xc0004afcc0, 0xc0007ae000, 0x3282dc8, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
istio.io/istio@/pilot/pkg/networking/core/v1alpha3/listener.go:1427 +0x1475
istio.io/istio/pilot/pkg/networking/core/v1alpha3.(*ConfigGeneratorImpl).buildSidecarOutboundListeners(0xc00046ddc0, 0xc0004afcc0, 0xc0007ae000, 0xc00147fe60, 0x0, 0x0, 0x0)
istio.io/istio@/pilot/pkg/networking/core/v1alpha3/listener.go:909 +0x96f
istio.io/istio/pilot/pkg/networking/core/v1alpha3.(*ListenerBuilder).buildSidecarOutboundListeners(...)
istio.io/istio@/pilot/pkg/networking/core/v1alpha3/listener_builder.go:201
istio.io/istio/pilot/pkg/networking/core/v1alpha3.(*ConfigGeneratorImpl).buildSidecarListeners(0xc00046ddc0, 0xc0004afcc0, 0xc0007ae000, 0xc00147fe60, 0xc00192b650, 0xc0006a1580)
istio.io/istio@/pilot/pkg/networking/core/v1alpha3/listener.go:304 +0xc6
istio.io/istio/pilot/pkg/networking/core/v1alpha3.(*ConfigGeneratorImpl).BuildListeners(0xc00046ddc0, 0xc0004afcc0, 0xc0007ae000, 0xc00147fe60, 0xc00192b810, 0x440756, 0xc000f85ce0)
istio.io/istio@/pilot/pkg/networking/core/v1alpha3/listener.go:284 +0x16e
istio.io/istio/pilot/pkg/proxy/envoy/v2.(*DiscoveryServer).generateRawListeners(0xc00014b4d0, 0xc0019a1680, 0xc00147fe60, 0xc000c2bf20, 0x1f61bb8, 0xc0004c9948)
istio.io/istio@/pilot/pkg/proxy/envoy/v2/lds.go:49 +0x6f
istio.io/istio/pilot/pkg/proxy/envoy/v2.(*DiscoveryServer).pushLds(0xc00014b4d0, 0xc0019a1680, 0xc00147fe60, 0xc000ba4160, 0x16, 0x2, 0x0)
istio.io/istio@/pilot/pkg/proxy/envoy/v2/lds.go:29 +0x7c
istio.io/istio/pilot/pkg/proxy/envoy/v2.(*DiscoveryServer).StreamAggregatedResources(0xc00014b4d0, 0x21a5f00, 0xc000c54320, 0x0, 0x0)
istio.io/istio@/pilot/pkg/proxy/envoy/v2/ads.go:270 +0xbfb
github.com/envoyproxy/go-control-plane/envoy/service/discovery/v2._AggregatedDiscoveryService_StreamAggregatedResources_Handler(0x1e5aee0, 0xc00014b4d0, 0x219a200, 0xc001065500, 0x3282dc8, 0xc0010a8000)
github.com/envoyproxy/go-control-plane@v0.9.1-0.20191002184426-9d865299d2ff/envoy/service/discovery/v2/ads.pb.go:181 +0xad
google.golang.org/grpc.(*Server).processStreamingRPC(0xc000814420, 0x21aafa0, 0xc0019a1500, 0xc0010a8000, 0xc000248d80, 0x3241780, 0xc0011c7580, 0x0, 0x0)
google.golang.org/grpc@v1.24.0/server.go:1199 +0xb2e
google.golang.org/grpc.(*Server).handleStream(0xc000814420, 0x21aafa0, 0xc0019a1500, 0xc0010a8000, 0xc0011c7580)
google.golang.org/grpc@v1.24.0/server.go:1279 +0xd30
google.golang.org/grpc.(*Server).serveStreams.func1.1(0xc001649b40, 0xc000814420, 0x21aafa0, 0xc0019a1500, 0xc0010a8000)
google.golang.org/grpc@v1.24.0/server.go:710 +0xbb
created by google.golang.org/grpc.(*Server).serveStreams.func1
google.golang.org/grpc@v1.24.0/server.go:708 +0xa1

Customer reported this crash happened in the istio-pilot image with sha256 digest 7b53d2a6574e15f00082848e1309cec36022a57919eff7212ec9ed2ad1231980.