Harmony Crash Report

The following is a log created by Harmony when running two mods in RimWorld together: 
CameraPlus and SameSpot. Both are here on GitHub under my name and the Harmony commit 81a27ed
is used with both mods: https://github.com/pardeike/Harmony/commit/81a27edb2d917c8be0fe25f2eae52b17ea9b529f

PC used: Windows 10, version 1607 14393.693
Intel i7-3770 16GB ram, 64bit x64 system

Debugging was done on offline RimWorld with replaced debug mono.ddl

The log shows SameSpot loading first (both have the same Harmony.dll and thus ony SameSpot gets
the dll loaded and the static vars initialized). RimWorld starts fine, both mods patch fine and
the game loads fine. Camera zoom is tested fine (CameraPlus working). Then when right-clicking
a colonists to a specific spot, the game crashes (first time use of SameSpot):

Initializing Cache
Cache - adding field type Harmony.HarmonyMethod
Cache - adding fieldinfo System.Type originalType
Cache - adding fieldinfo System.String methodName
Cache - adding fieldinfo System.Type[] parameter
Cache - adding fieldinfo System.Int32 prioritiy
Cache - adding fieldinfo System.String[] before
Cache - adding fieldinfo System.String[] after
PeekJump at 0x00000000181ee1e0 => zero
Checking payload for Boolean <>m__60C(IntVec3) => null
Target
# 0x0000000013f00008  55 8b ec 83  ec 48 90 90 
# 0x0000000013f00010  90 90 90 90  3b 05 00 00 
# 0x0000000013f00018  2f 01 90 90  90 90 90 90 
# 0x0000000013f00020  8b 45 08 8b  40 08 8b 40 
KeepAlive - static reference array initialized
KeepAlive - Boolean <>m__60C_original(Object, IntVec3)
KeepAlive - Boolean <>m__60C_original(System.Object, IntVec3)
KeepAlive - Boolean <>m__60C_wrapper(Object, IntVec3)
KeepAlive - Boolean <>m__60C_wrapper(System.Object, IntVec3)

Detouring source 0x00000000181ee1e0 to target 0x0000000013f001c0 (new)
# Source
# 0x00000000181ee1e0  55 8b ec 83  ec 48 90 90 
# 0x00000000181ee1e8  90 90 90 90  3b 05 00 00 
# 0x00000000181ee1f0  2f 01 90 90  90 90 90 90 
# 0x00000000181ee1f8  8b 45 08 8b  40 08 8b 40 
# Target
# 0x0000000013f001c0  55 8b ec 83  ec 18 c6 45 
# 0x0000000013f001c8  f2 00 c6 45  f3 00 90 90 
# 0x0000000013f001d0  90 90 90 90  3b 05 00 00 
# 0x0000000013f001d8  2f 01 90 90  90 90 90 90 
KeepAlive - Void HarmonyMemoryMethod1()
Memory - created at 0x000000001bdbbd98 (len 31)
# Contents
# 0x000000001bdbbd98  55 8b ec 83  ec 08 90 90 
# 0x000000001bdbbda0  90 90 90 90  3b 05 00 00 
# 0x000000001bdbbda8  2f 01 90 90  90 90 90 90 
# 0x000000001bdbbdb0  b8 01 00 00  00 b9 00 
Writing intermediate jump to target at 0x000000001bdbbda7
Jump written to 0x000000001bdbbda7 with offset 0xf8144414 => 0x0000000013f001c0 (32bit)
# Contents after detour
# 0x000000001bdbbd98  48 61 72 6d  6f 6e 79 f8 
# 0x000000001bdbbda0  09 91 15 00  04 00 00 e9 
# 0x000000001bdbbda8  14 44 14 f8  00 00 00 00 
# 0x000000001bdbbdb0  00 00 00 00  00 b9 00 
Jump written to 0x00000000181ee1e0 with offset 0x03bcdbc2 => 0x000000001bdbbda7 (32bit)
PeekJump at 0x000000001bdbd410 => zero
Checking payload for Void ApplyPositionToGameObject() => null
Target
# 0x0000000013f00300  55 8b ec 83  ec 58 8d 45 
# 0x0000000013f00308  b8 33 c0 89  45 b8 89 45 
# 0x0000000013f00310  bc 89 45 c0  90 90 90 90 
# 0x0000000013f00318  90 90 3b 05  00 00 2f 01 
KeepAlive - Void ApplyPositionToGameObject_original(Object)
KeepAlive - Void ApplyPositionToGameObject_original(System.Object)
KeepAlive - Void ApplyPositionToGameObject_wrapper(Object)
KeepAlive - Void ApplyPositionToGameObject_wrapper(System.Object)

Detouring source 0x000000001bdbd410 to target 0x0000000013f00560 (new)
# Source
# 0x000000001bdbd410  55 8b ec 83  ec 58 8d 45 
# 0x000000001bdbd418  b8 33 c0 89  45 b8 89 45 
# 0x000000001bdbd420  bc 89 45 c0  90 90 90 90 
# 0x000000001bdbd428  90 90 3b 05  00 00 2f 01 
# Target
# 0x0000000013f00560  55 8b ec 83  ec 08 c6 45 
# 0x0000000013f00568  ff 00 90 90  90 90 90 90 
# 0x0000000013f00570  3b 05 00 00  2f 01 90 90 
# 0x0000000013f00578  90 90 90 90  b8 e0 b4 8e 
KeepAlive - Void HarmonyMemoryMethod2()
Memory - created at 0x000000001bdc0b68 (len 31)
# Contents
# 0x000000001bdc0b68  55 8b ec 83  ec 08 90 90 
# 0x000000001bdc0b70  90 90 90 90  3b 05 00 00 
# 0x000000001bdc0b78  2f 01 90 90  90 90 90 90 
# 0x000000001bdc0b80  b8 01 00 00  00 b9 00 
Writing intermediate jump to target at 0x000000001bdc0b77
Jump written to 0x000000001bdc0b77 with offset 0xf813f9e4 => 0x0000000013f00560 (32bit)
# Contents after detour
# 0x000000001bdc0b68  48 61 72 6d  6f 6e 79 88 
# 0x000000001bdc0b70  e9 1d 1b 00  04 00 00 e9 
# 0x000000001bdc0b78  e4 f9 13 f8  00 00 00 00 
# 0x000000001bdc0b80  00 00 00 00  00 b9 00 
Jump written to 0x000000001bdbd410 with offset 0x00003762 => 0x000000001bdc0b77 (32bit)
Wrapper - ApplyPositionToGameObject
Cache - adding property type Verse.CameraDriver
Cache - adding propertyinfo UnityEngine.Camera MyCamera
Wrapper - ApplyPositionToGameObject
Wrapper - ApplyPositionToGameObject
......

Unhandled exception at 0x13f001d0 in RimWorld1393Win.exe: 0xC0000005: Access violation writing location 0x89e0458b.

Visual Studio Debugger breaks into (*)
  13F001C0 45                   inc         ebp  
  13F001C1 B8 8B 45 E0 89       mov         eax,89E0458Bh  
  13F001C6 45                   inc         ebp  
  13F001C7 BC 8B 45 E4 89       mov         esp,89E4458Bh  
  13F001CC 45                   inc         ebp  
  13F001CD C0 3B 05             sar         byte ptr [ebx],5  
* 13F001D0 00 00                add         byte ptr [eax],al  
  13F001D2 2F                   das    
  13F001D3 01 90 90 90 90 90    add         dword ptr [eax-6F6F6F70h],edx  
  13F001D9 90                   nop  
  13F001DA 8D 45 B8             lea         eax,[ebp-48h]  
  13F001DD D9 05 F8 25 A6 18    fld         dword ptr ds:[18A625F8h]   
  13F001E3 D9 5D BC             fstp        dword ptr [ebp-44h] 

Copied from log above for easier viewing: Target wrapper for SameSpot (before patching):
# 0x0000000013f001c0  55 8b ec 83  ec 18 c6 45 
# 0x0000000013f001c8  f2 00 c6 45  f3 00 90 90 
# 0x0000000013f001d0  90 90 90 90  3b 05 00 00 
# 0x0000000013f001d8  2f 01 90 90  90 90 90 90 

Obviously, the JITed content of the DynamicMethod (or its delegate) has changed regardless of Harmony forcing a JIT on it.

Questions:

- why is this happening
- how can this be prevented