Crash in PDFView / PDFPageAnalyzerV2

Hello. Some users of my app experience crashes that mention PDFKit. I managed to find out what specific PDF file caused the crash and created a sample that demonstrates the issue and created a bug report in Feedback Assistant (FB22409977). Unfortunately I didn't get any answer for over a month, hence I'm writing it here so others can see that this is a known issue.

The crash repro sample is very simple, it's just a PDFView that opens a bundled PDF file upon application lanunch. To cause the crash it is only needed to zoom-in and move around the page that has a table. The crash happens when the system tries to do some sort of OCR. The original crash report came from iPhone 11 user running iOS 26.3.1. Recently another user with iPhone 16 Pro Max running 26.5 experienced the same crash.

Thread 12 Queue : PDFKWit.PDFDocument.formFillingQueue (serial)
#0	0x000000018d320bd8 in PageLayout::GetBoundsForRangeWithinLine ()
#1	0x000000018d320c88 in PageLayout::GetBoundsForTextRange ()
#2	0x000000018d393028 in CGPDFTaggedNodeCreateCopyWithStringRange ()
#3	0x000000018d316630 in invocation function for block in TaggedParser::InsertLinkAnnotationsIntoStructureTree(CGPDFTaggedNode*, CGPDFPage*, PageLayout&) ()
#4	0x000000018d104f00 in CGPDFPageEnumerateAnnotations ()
#5	0x000000018d106968 in CGPDFPageCopyRootTaggedNode ()
#6	0x000000018d106710 in CGPDFPageInsertTableDescriptions ()
#7	0x00000001957a65b8 in +[PDFPageAnalyzerV2 addTablesFromVisionDocument:documentImage:toPage:withBox:] ()
#8	0x00000001957a3030 in +[PDFPageAnalyzerV2 analyzePage:withBox:requestTypes:] ()
#9	0x000000019584c018 in __31-[PDFView visiblePagesChanged:]_block_invoke ()

When CG_PDF_VERBOSE env variable is set, "New text range needs to be within the original node's text range." warning is printed to console several times before the crash happens.

Crash in PDFView / PDFPageAnalyzerV2
 
 
Q