求助：排查PDFKit中CFArrayGetCount EXC_BAD_ACCESS崩溃问题

已按用户操作流程复现崩溃失败，开启VoiceOver重复操作也无法重现（Firebase收集的崩溃日志均包含UIAccessibility相关痕迹，推测与无障碍流程有关）。

业务流程：获取图片并转换为PDF，通过Apple官方PDFKit创建PDFView并加载展示。

崩溃日志 #

Crashed: com.apple.main-thread
0  CoreFoundation                 0x7c59c CFArrayGetCount + 8
1  CorePDF                        0x28c1c CGPDFTaggedNodeEnumerateChildren + 52
2  CorePDF                        0x28b70 CGPDFTaggedNodeGetBounds + 244
3  PDFKit                         0x6400 (Missing UUID 4dedb563f2df3dceae5066d6b4718b9f)
4  UIAccessibility                0x818e0 ___axuiElementForNotificationData_block_invoke + 56
5  UIAccessibility                0x5e370 __79-[NSObject(AXPrivCategory) _accessibilityFindAnyAXDescendant:byAddingElements:]_block_invoke + 84
6  UIAccessibility                0x5e4b4 -[NSObject(AXPrivCategory) _accessibilityFindAXDescendants:byAddingElements:] + 232
7  UIAccessibility                0x5e290 -[NSObject(AXPrivCategory) _accessibilityFindAnyAXDescendant:byAddingElements:] + 236
8  UIAccessibility                0x5e990 -[NSObject(AXPrivCategory) _accessibilityFindDescendant:] + 208
9  UIAccessibility                0x81748 _axuiElementForNotificationData + 356
10 UIAccessibility                0x82094 _massageAssociatedElementBeforePost + 80
11 UIAccessibility                0x83470 _UIAXBroadcastMainThread + 640
12 UIAccessibility                0x84abc ___UIAccessibilityBroadcastNotificationFunction_block_invoke + 372
13 libdispatch.dylib              0x24b4 _dispatch_call_block_and_release + 32
14 libdispatch.dylib              0x3fdc _dispatch_client_callout + 20
15 libdispatch.dylib              0x127f4 _dispatch_main_queue_drain + 928
16 libdispatch.dylib              0x12444 _dispatch_main_queue_callback_4CF + 44
17 CoreFoundation                 0x9a6d8 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 16
18 CoreFoundation                 0x7c03c __CFRunLoopRun + 2036
19 CoreFoundation                 0x80ec0 CFRunLoopRunSpecific + 612
20 GraphicsServices               0x1368 GSEventRunModal + 164
21 UIKitCore                      0x3a186c -[UIApplication _run] + 888
22 UIKitCore                      0x3a14d0 UIApplicationMain + 340
23 *********                      0x5dd4 main + 59 (main.m:59)
24 ???                            0x1b3306960 (Missing)

疑问 #

• 该崩溃的可能根因
• 后续可尝试的排查及修复方向

内容的提问来源于stack exchange，提问作者ShashiKant_B