Repository: flutter
Issue: [engine] potential crash on deref of canvas_image_ in single_frame_codec.cc.
Labels: c: regression,c: crash,platform-ios,engine,a: images,a: production,P2,needs repro info,team-engine,triaged-engine

### Steps to reproduce

I have a live app using flutter `3.27.1` that i have released yesterday with 30k daily active users. 
I have received a new crash that i had not in `3.24.x` apparently from flutter `UI` : 

Please see the full [StackTrace](https://github.com/user-attachments/files/18285076/stack.txt) for more information.

### Expected results

The app should not crash

### Actual results

The app is crashing

### Code sample

<details open><summary>Code sample</summary>

```dart
[Paste your code here]
```

</details>


### Screenshots or Video

<details open>
<summary>Screenshots / Video demonstration</summary>

[Upload media here]

</details>


### Logs

<details open><summary>Logs</summary>

```console
Crashed: io.flutter.1.ui
0  Flutter                        0x4db148 flutter::SingleFrameCodec::getNextFrame(_Dart_Handle*) + 303 (SkRefCnt.h:303)
1  App                            0xd53c stub CallNativeThroughSafepoint + 21820
2  App                            0x726c60 _NativeCodec.getNextFrame + 2286 (painting.dart:2286)
3  App                            0x726b3c _NativeCodec.getNextFrame + 24 (exceptions.dart:24)
4  App                            0x726214 MultiImageStreamCompleter._decodeNextFrameAndSchedule + 133 (multi_image_stream_completer.dart:133)
5  App                            0x1b2fb0 ImageStream.addListener + 177 (multi_image_stream_completer.dart:177)
6  App                            0x1bbb40 _ImageState._listenToStream + 1233 (image.dart:1233)
7  App                            0x1bb300 _ImageState.didChangeDependencies + 1090 (image.dart:1090)
8  App                            0xe2d58 StatefulElement.performRebuild + 5794 (framework.dart:5794)
9  App                            0x7152a8 BuildScope._tryRebuild + 2697 (framework.dart:2697)
10 App                            0x714e98 BuildScope._flushDirtyElements + 2792 (framework.dart:2792)
11 App                            0x714d8c BuildOwner.buildScope + 3048 (framework.dart:3048)
12 App                            0xded60 _LayoutBuilderElement._rebuildWithConstraints + 194 (layout_builder.dart:194)
13 App                            0xdec60 _LayoutBuilderElement._rebuildWithConstraints + 194 (layout_builder.dart:194)
14 App                            0x127a98 RenderObject.invokeLayoutCallback.<anonymous closure> + 2738 (object.dart:2738)
15 App                            0x71b618 PipelineOwner._enableMutationsToDirtySubtrees + 1108 (object.dart:1108)
16 App                            0x71b598 RenderObject.invokeLayoutCallback + 2738 (object.dart:2738)
17 App                            0x12a1d8 RenderConstrainedLayoutBuilder.rebuildIfNecessary + 284 (layout_builder.dart:284)
18 App                            0x12a08c _RenderLayoutBuilder.performLayout + 379 (layout_builder.dart:379)
19 App                            0x757ae4 RenderObject._layoutWithoutResize + 2466 (object.dart:2466)
20 App                            0x7579b0 PipelineOwner.flushLayout + 1074 (object.dart:1074)
21 App                            0x757a48 PipelineOwner.flushLayout + 1075 (object.dart:1075)
22 App                            0x2891fc RendererBinding.drawFrame + 610 (binding.dart:610)
23 App                            0x288e70 WidgetsBinding.drawFrame + 1183 (binding.dart:1183)
24 App                            0x2887d4 RendererBinding._handlePersistentFrameCallback + 476 (binding.dart:476)
25 App                            0x288798 RendererBinding._handlePersistentFrameCallback + 474 (binding.dart:474)
26 App                            0x709848 SchedulerBinding._invokeFrameCallback + 1403 (binding.dart:1403)
27 App                            0x70960c SchedulerBinding.handleDrawFrame + 144 (growable_array.dart:144)
28 App                            0x44c08 SchedulerBinding._handleDrawFrame + 1158 (binding.dart:1158)
29 App                            0x44aec SchedulerBinding._handleDrawFrame + 1158 (binding.dart:1158)
30 App                            0x3e280 _invoke + 314 (hooks.dart:314)
31 App                            0x431ac PlatformDispatcher._drawFrame + 426 (platform_dispatcher.dart:426)
32 App                            0x43170 _drawFrame + 281 (hooks.dart:281)
33 App                            0x431dc _drawFrame + 281 (hooks.dart:281)
34 App                            0xfb8c stub InvokeDartCode + 31628
35 Flutter                        0x63c034 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&) + 33 (allocation.h:33)
36 Flutter                        0x7495bc Dart_InvokeClosure + 4664 (dart_api_impl.cc:4664)
37 Flutter                        0x5cb3dc flutter::Shell::OnAnimatorBeginFrame(fml::TimePoint, unsigned long long) + 30 (dart_invoke.cc:30)
38 Flutter                        0x5adc78 std::_fl::__function::__func<flutter::Animator::AwaitVSync()::$_0, std::_fl::allocator<flutter::Animator::AwaitVSync()::$_0>, void (std::_fl::unique_ptr<flutter::FrameTimingsRecorder, std::_fl::default_delete<flutter::FrameTimingsRecorder>>)>::operator()(std::_fl::unique_ptr<flutter::FrameTimingsRecorder, std::_fl::default_delete<flutter::FrameTimingsRecorder>>&&) + 186 (ref_ptr.h:186)
39 Flutter                        0x5de554 std::_fl::__function::__func<flutter::VsyncWaiter::FireCallback(fml::TimePoint, fml::TimePoint, bool)::$_0, std::_fl::allocator<flutter::VsyncWaiter::FireCallback(fml::TimePoint, fml::TimePoint, bool)::$_0>, void ()>::operator()() + 302 (unique_ptr.h:302)
40 Flutter                        0x85c9c fml::MessageLoopImpl::FlushTasks(fml::FlushType) + 128 (message_loop_impl.cc:128)
41 Flutter                        0x89314 fml::MessageLoopDarwin::OnTimerFire(__CFRunLoopTimer*, fml::MessageLoopDarwin*) + 86 (message_loop_darwin.mm:86)
42 CoreFoundation                 0xb63f8 <redacted> + 32
43 CoreFoundation                 0xb609c <redacted> + 1012
44 CoreFoundation                 0xb5bf0 <redacted> + 288
45 CoreFoundation                 0x540fc <redacted> + 1856
46 CoreFoundation                 0x535b8 CFRunLoopRunSpecific + 572
47 Flutter                        0x89400 fml::MessageLoopDarwin::Run() + 52 (message_loop_darwin.mm:52)
48 Flutter                        0x890e0 std::_fl::__function::__func<fml::Thread::Thread(std::_fl::function<void (fml::Thread::ThreadConfig const&)> const&, fml::Thread::ThreadConfig const&)::$_0, std::_fl::allocator<fml::Thread::Thread(std::_fl::function<void (fml::Thread::ThreadConfig const&)> const&, fml::Thread::ThreadConfig const&)::$_0>, void ()>::operator()() + 94 (message_loop_impl.cc:94)
49 Flutter                        0x88df0 fml::ThreadHandle::ThreadHandle(std::_fl::function<void ()>&&)::$_0::__invoke(void*) + 470 (function.h:470)
50 libsystem_pthread.dylib        0x637c _pthread_start + 136
51 libsystem_pthread.dylib        0x1494 thread_start + 8
```

</details>


### Flutter Doctor output

<details open><summary>Doctor output</summary>

```console
[✓] Flutter (Channel stable, 3.27.1, on macOS 15.2 24C101 darwin-x64, locale fr-FR)
    • Flutter version 3.27.1 on channel stable at /Users/foxtom/Desktop/flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision 17025dd882 (2 weeks ago), 2024-12-17 03:23:09 +0900
    • Engine revision cb4b5fff73
    • Dart version 3.6.0
    • DevTools version 2.40.2

[✓] Android toolchain - develop for Android devices (Android SDK version 35.0.0)
    • Android SDK at /Users/foxtom/Library/Android/sdk
    • Platform android-35, build-tools 35.0.0
    • Java binary at: /Applications/Android Studio.app/Contents/jbr/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build 21.0.3+-79915915-b509.11)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 16.2)
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Build 16C5032a
    • CocoaPods version 1.16.2

[✓] Chrome - develop for the web
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 2024.2)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 21.0.3+-79915915-b509.11)

[✓] VS Code (version 1.96.2)
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension can be installed from:
      🔨 https://marketplace.visualstudio.com/items?itemName=Dart-Code.flutter

[✓] Connected device (4 available)
    • Now You See Me (mobile) • 00008020-001204401E78002E • ios            • iOS 18.2 22C152
    • macOS (desktop)         • macos                     • darwin-x64     • macOS 15.2 24C101 darwin-x64
    • Chrome (web)            • chrome                    • web-javascript • Google Chrome 131.0.6778.205

[✓] Network resources
    • All expected network resources are available.

• No issues found!
```

</details>