From
How to unc0ver a 0-day in 4 hours or less
So, to summarize: the LightSpeed bug was fixed in iOS 12 with a patch that didn’t address the root cause and instead just turned the race condition double-free into a memory leak. Then, in iOS 13, this memory leak was identified as a bug and “fixed” by reintroducing the original bug, again without addressing the root cause of the issue. And this security regression could have been found trivially by running the original POC from the blog post.
In the conclusion:
The combination of the SockPuppet regression in iOS 12.4 and the LightSpeed regression in iOS 13 strongly suggests that Apple did not run effective regression tests on at least these old security bugs (and these were very public bugs that got a lot of attention). Running effective regression tests is a necessity for basic software testing, and a common starting point for exploitation.
Further reading:
Return of the iOS sandbox escape: lightspeed’s back in the race!!