iOS app crashes on in-app purchase, only on App Store version

It's my first time doing in-app purchases. Everything seemed to work fine when I tested on my device (iPod 4 Touch), but after submitting the app to the App Store, I downloaded it and the app crashes (or more precisely I think, aborts do to an exception) when I press the button that tries to make the purchase. Not even Apple's confirmation window ("Do you really want to buy x for $0.99?") appears.

It seems to be crashing in the following code:

-(void) unlockButtonTapped:(id)sender
{

    iapLevel = selectedLevel;

    int productIndex = selectedLevel - 1;

    if (productIndex == 4) productIndex = 0;
    if ((productIndex >= 4) || (productIndex <= -1)) return;

    // crash is likely in the following lines
    SKProduct *product = (SKProduct *) _myProducts[productIndex];

    SKMutablePayment *payment = [SKMutablePayment paymentWithProduct:product];

    [[SKPaymentQueue defaultQueue] addPayment:payment];

}

Eariler, I do the following to get the product identifiers:

NSURL *url = [[NSBundle mainBundle] URLForResource:@"product_identifiers" withExtension:@"plist"];

NSArray *productIdentifiers = [NSArray arrayWithContentsOfURL:url];

[self validateProductIdentifiers:productIdentifiers];

Which calls:

-(void) validateProductIdentifiers:(NSArray *)productIdentifiers
{
    SKProductsRequest *productsRequest = [[SKProductsRequest alloc] initWithProductIdentifiers:[NSSet setWithArray:productIdentifiers]];

    productsRequest.delegate = self;

    [productsRequest start];
}

Which calls:

- (void)productsRequest:(SKProductsRequest *)request didReceiveResponse:(SKProductsResponse *)response

{
    self.myProducts = response.products;   // set _myProducts NSArray

    for (NSString *invalidIdentifier in response.invalidProductIdentifiers) {
        // Handle any invalid product identifiers.
    }

    [self displayStoreUI];  // Custom method
}

And finally, the crash log shows the following:

Incident Identifier: AC50936F-1406-4AB1-A12D-65D30AC60898
CrashReporter Key:   946cc7aded54c1889b716055e47af939ec345f94
Hardware Model:      iPod4,1
Process:         Freeway Fury [3804]
Path:            /var/mobile/Applications/35F0210C-4CAB-41DE-AC7D-1D3A7BA16C1F/Freeway Fury.app/Freeway Fury
Identifier:      Freeway Fury
Version:         ??? (???)
Code Type:       ARM (Native)
Parent Process:  launchd [1]

Date/Time:       2014-01-30 21:46:02.041 +0000
OS Version:      iOS 6.1.3 (10B329)
Report Version:  104

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Crashed Thread:  0

Last Exception Backtrace:
0   CoreFoundation                  0x3218329e __exceptionPreprocess + 158
1   libobjc.A.dylib                 0x39e0197a objc_exception_throw + 26
2   CoreFoundation                  0x320cde88 -[__NSArrayI objectAtIndex:] + 160
3   Freeway Fury                    0x00105068 -[LevelSelectLayer unlockButtonTapped:] (LevelSelectLayer.mm:1092)
4   Freeway Fury                    0x0008ccee -[CCMenu ccTouchEnded:withEvent:] (CCMenu.m:223)
5   Freeway Fury                    0x000b488e -[CCTouchDispatcher touches:withEvent:withTouchType:] (CCTouchDispatcher.m:257)
6   Freeway Fury                    0x000b4c9a -[CCTouchDispatcher touchesEnded:withEvent:] (CCTouchDispatcher.m:331)
7   UIKit                           0x33f9e5ec -[UIWindow _sendTouchesForEvent:] + 520
8   UIKit                           0x33f8b7fc -[UIApplication sendEvent:] + 376
9   UIKit                           0x33f8b116 _UIApplicationHandleEvent + 6150
10  GraphicsServices                0x35c7d59e _PurpleEventCallback + 586
11  GraphicsServices                0x35c7d1ce PurpleEventCallback + 30
12  CoreFoundation                  0x3215816e __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 30
13  CoreFoundation                  0x32158112 __CFRunLoopDoSource1 + 134
14  CoreFoundation                  0x32156f94 __CFRunLoopRun + 1380
15  CoreFoundation                  0x320c9eb8 CFRunLoopRunSpecific + 352
16  CoreFoundation                  0x320c9d44 CFRunLoopRunInMode + 100
17  GraphicsServices                0x35c7c2e6 GSEventRunModal + 70
18  UIKit                           0x33fdf2fc UIApplicationMain + 1116
19  Freeway Fury                    0x000ca48e main (main.m:14)
20  Freeway Fury                    0x000708c4 ___lldb_unnamed_function1$$Freeway Fury + 36


Thread 0 name:  Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   libsystem_kernel.dylib          0x3a2ff350 __pthread_kill + 8
1   libsystem_c.dylib               0x3a27611e pthread_kill + 54
2   libsystem_c.dylib               0x3a2b296e abort + 90
3   libc++abi.dylib                 0x39850d4a abort_message + 70
4   libc++abi.dylib                 0x3984dff4 default_terminate() + 20
5   libobjc.A.dylib                 0x39e01a74 _objc_terminate() + 144
6   libc++abi.dylib                 0x3984e078 safe_handler_caller(void (*)()) + 76
7   libc++abi.dylib                 0x3984e110 std::terminate() + 16
8   libc++abi.dylib                 0x3984f594 __cxa_rethrow + 84
9   libobjc.A.dylib                 0x39e019cc objc_exception_rethrow + 8
10  CoreFoundation                  0x320c9f1c CFRunLoopRunSpecific + 452
11  CoreFoundation                  0x320c9d44 CFRunLoopRunInMode + 100
12  GraphicsServices                0x35c7c2e6 GSEventRunModal + 70
13  UIKit                           0x33fdf2fc UIApplicationMain + 1116
14  Freeway Fury                    0x000ca48e main (main.m:14)
15  Freeway Fury                    0x000708c4 ___lldb_unnamed_function1$$Freeway Fury + 36

Thread 1:
0   libsystem_kernel.dylib          0x3a2ffd98 __workq_kernreturn + 8
1   libsystem_c.dylib               0x3a24dcf6 _pthread_workq_return + 14
2   libsystem_c.dylib               0x3a24da12 _pthread_wqthread + 362
3   libsystem_c.dylib               0x3a24d8a0 start_wqthread + 4

Thread 2 name:  Dispatch queue: com.apple.libdispatch-manager
Thread 2:
0   libsystem_kernel.dylib          0x3a2ef648 kevent64 + 24
1   libdispatch.dylib               0x3a2284ec _dispatch_mgr_invoke + 792
2   libdispatch.dylib               0x3a21adf4 _dispatch_mgr_thread$VARIANT$up + 32

Thread 3 name:  WebThread
Thread 3:
0   libsystem_kernel.dylib          0x3a2eeeb4 mach_msg_trap + 20
1   libsystem_kernel.dylib          0x3a2ef048 mach_msg + 36
2   CoreFoundation                  0x32158040 __CFRunLoopServiceMachPort + 124
3   CoreFoundation                  0x32156d9e __CFRunLoopRun + 878
4   CoreFoundation                  0x320c9eb8 CFRunLoopRunSpecific + 352
5   CoreFoundation                  0x320c9d44 CFRunLoopRunInMode + 100
6   WebCore                         0x380b7500 RunWebThread(void*) + 440
7   libsystem_c.dylib               0x3a25830e _pthread_start + 306
8   libsystem_c.dylib               0x3a2581d4 thread_start + 4

Thread 4:
0   libsystem_kernel.dylib          0x3a2ffd98 __workq_kernreturn + 8
1   libsystem_c.dylib               0x3a24dcf6 _pthread_workq_return + 14
2   libsystem_c.dylib               0x3a24da12 _pthread_wqthread + 362
3   libsystem_c.dylib               0x3a24d8a0 start_wqthread + 4

Thread 5 name:  com.apple.NSURLConnectionLoader
Thread 5:
0   libsystem_kernel.dylib          0x3a2eeeb4 mach_msg_trap + 20
1   libsystem_kernel.dylib          0x3a2ef048 mach_msg + 36
2   CoreFoundation                  0x32158040 __CFRunLoopServiceMachPort + 124
3   CoreFoundation                  0x32156d9e __CFRunLoopRun + 878
4   CoreFoundation                  0x320c9eb8 CFRunLoopRunSpecific + 352
5   CoreFoundation                  0x320c9d44 CFRunLoopRunInMode + 100
6   Foundation                      0x32a163d0 +[NSURLConnection(Loader) _resourceLoadLoop:] + 304
7   Foundation                      0x32a99e80 __NSThread__main__ + 968
8   libsystem_c.dylib               0x3a25830e _pthread_start + 306
9   libsystem_c.dylib               0x3a2581d4 thread_start + 4

Thread 6 name:  com.apple.CFSocket.private
Thread 6:
0   libsystem_kernel.dylib          0x3a2ff594 select$DARWIN_EXTSN + 20
1   CoreFoundation                  0x3215c1f2 __CFSocketManager + 674
2   libsystem_c.dylib               0x3a25830e _pthread_start + 306
3   libsystem_c.dylib               0x3a2581d4 thread_start + 4

Thread 7 name:  AURemoteIO::IOThread
Thread 7:
0   libsystem_kernel.dylib          0x3a2eeeb4 mach_msg_trap + 20
1   libsystem_kernel.dylib          0x3a2ef048 mach_msg + 36
2   AudioToolbox                    0x31c4c91c AURemoteIO::IOThread::Run() + 104
3   AudioToolbox                    0x31c4ec84 AURemoteIO::IOThread::Entry(void*) + 4
4   AudioToolbox                    0x31b8c882 CAPThread::Entry(CAPThread*) + 294
5   libsystem_c.dylib               0x3a25830e _pthread_start + 306
6   libsystem_c.dylib               0x3a2581d4 thread_start + 4

Thread 8 name:  AQClient
Thread 8:
0   libsystem_kernel.dylib          0x3a2eeeb4 mach_msg_trap + 20
1   libsystem_kernel.dylib          0x3a2ef048 mach_msg + 36
2   CoreFoundation                  0x32158040 __CFRunLoopServiceMachPort + 124
3   CoreFoundation                  0x32156d9e __CFRunLoopRun + 878
4   CoreFoundation                  0x320c9eb8 CFRunLoopRunSpecific + 352
5   CoreFoundation                  0x320c9d44 CFRunLoopRunInMode + 100
6   AudioToolbox                    0x31bab6fe GenericRunLoopThread::Entry(void*) + 134
7   AudioToolbox                    0x31b8c882 CAPThread::Entry(CAPThread*) + 294
8   libsystem_c.dylib               0x3a25830e _pthread_start + 306
9   libsystem_c.dylib               0x3a2581d4 thread_start + 4

Thread 0 crashed with ARM Thread State (32-bit):
    r0: 0x00000000    r1: 0x00000000      r2: 0x00000000      r3: 0x3bdb0534
    r4: 0x00000006    r5: 0x3bdb0b88      r6: 0x1ed0cf54      r7: 0x2fd98a24
    r8: 0x1ed0cf30    r9: 0x00000888     r10: 0x1ed3c4d0     r11: 0x37c20885
    ip: 0x00000148    sp: 0x2fd98a18      lr: 0x3a276123      pc: 0x3a2ff350
  cpsr: 0x000f0010

Binary Images:
   0x6b000 -   0x156fff +Freeway Fury armv7  <23dd202309ba3cba9eb31251d7aab352> /var/mobile/Applications/35F0210C-4CAB-41DE-AC7D-1D3A7BA16C1F/Freeway Fury.app/Freeway Fury
0x2fe17000 - 0x2fe37fff  dyld armv7  <280610df5ed43ec7aa00629a27009302> /usr/lib/dyld
0x311ca000 - 0x3129afff  IMGSGX535GLDriver armv7  <e5b6eec1a6ca3d249e2d63bf74d52c86> /System/Library/Extensions/IMGSGX535GLDriver.bundle/IMGSGX535GLDriver
0x312a4000 - 0x3138afff  AVFoundation armv7  <320761e836883aeabf3cb5c53edb636d> /System/Library/Frameworks/AVFoundation.framework/AVFoundation
0x3138b000 - 0x3138bfff  Accelerate armv7  <b68ff92e404931f3bcb6361720f77724> /System/Library/Frameworks/Accelerate.framework/Accelerate
0x3138c000 - 0x314cafff  vImage armv7  <30522b92940d3dd184c8e46780594048> /System/Library/Frameworks/Accelerate.framework/Frameworks/vImage.framework/vImage
0x314cb000 - 0x315aefff  libBLAS.dylib armv7  <d8edada1cea133458ca779e34a3a7f88> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libBLAS.dylib
0x315af000 - 0x31864fff  libLAPACK.dylib armv7  <9e08aead79d13043bab622402a270fba> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libLAPACK.dylib
0x31865000 - 0x318befff  libvDSP.dylib armv7  <09e2a5e3e9203950890ba57592523132> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libvDSP.dylib
0x318bf000 - 0x318d0fff  libvMisc.dylib armv7  <7b7d4ccc9f2b364cb0da4251e745545d> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libvMisc.dylib
0x318d1000 - 0x318d1fff  vecLib armv7  <a7751c047dcc35ba8885212e1938b93f> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/vecLib
(truncated)

The crash appears to be from:

SKProduct *product = (SKProduct *) _myProducts[productIndex];

The error is because productIndex is out of bounds. You are asking for a product index that is higher than the number of objects in the _myProducts array.

You need to analyze how you populate _myProducts and adjust your logic so your productIndex can't be bigger than the array.