Repository: flutter
Issue: iOS App crash on some device (includes macOS, iOS 11.4, and iOS11.3)
Labels: c: crash,engine,a: production,P2,needs repro info,team-engine,triaged-engine

### Is there an existing issue for this?

- [X] I have searched the [existing issues](https://github.com/flutter/flutter/issues)
- [X] I have read the [guide to filing a bug](https://flutter.dev/docs/resources/bug-reports)

### Steps to reproduce

Unfortunately I could not yet reproduce this bug with an example app, but in previous versions of flutter there were no issues.
This bug only occurs on mostly mac device, and a little  iOS11 device.  
And it starts when i upgrade flutter from 3.3.6 to 3.10.5(impeller enabled)，many mac users can't use our app。

### Expected results

The app should not crash.

### Actual results

It crashs on mostly mac device, and a little device on iOS11.  


### Code sample

<details><summary>Code sample</summary>

No sample code

</details>


### Screenshots or Video

<details>
<summary>Screenshots / Video demonstration</summary>

[Upload media here]

</details>


### Logs

<details><summary>Logs</summary>

```

EXC_BAD_ACCESS： undefined Diagnosis:Attempted to dereference garbage pointer 0xa8.

Flutter#flutter::GPUSurfaceMetalImpeller::AcquireFrame(SkISize const&)
Flutter#flutter::GPUSurfaceMetalImpeller::AcquireFrame(SkISize const&)
Flutter#flutter::Rasterizer::DrawToSurfaceUnsafe(flutter::FrameTimingsRecorder&, flutter::LayerTree&)
Flutter#std::_LIBCPP_ABI_NAMESPACE::__function::__func<flutter::Rasterizer::DrawToSurface(flutter::FrameTimingsRecorder&, flutter::LayerTree&)::$_1, std::_LIBCPP_ABI_NAMESPACE::allocator<flutter::Rasterizer::DrawToSurface(flutter::FrameTimingsRecorder&, flutter::LayerTree&)::$_1>, void ()>::operator()()
Flutter#fml::SyncSwitch::Execute(fml::SyncSwitch::Handlers const&) const
Flutter#flutter::Rasterizer::DrawToSurface(flutter::FrameTimingsRecorder&, flutter::LayerTree&)
Flutter#std::_LIBCPP_ABI_NAMESPACE::__function::__func<flutter::Rasterizer::Draw(std::_LIBCPP_ABI_NAMESPACE::shared_ptr<flutter::Pipeline<flutter::LayerTreeItem> > const&, std::_LIBCPP_ABI_NAMESPACE::function<bool (flutter::LayerTree&)>)::$_1, std::_LIBCPP_ABI_NAMESPACE::allocator<flutter::Rasterizer::Draw(std::_LIBCPP_ABI_NAMESPACE::shared_ptr<flutter::Pipeline<flutter::LayerTreeItem> > const&, std::_LIBCPP_ABI_NAMESPACE::function<bool (flutter::LayerTree&)>)::$_1>, void (std::_LIBCPP_ABI_NAMESPACE::unique_ptr<flutter::LayerTreeItem, std::_LIBCPP_ABI_NAMESPACE::default_delete<flutter::LayerTreeItem> >)>::operator()(std::_LIBCPP_ABI_NAMESPACE::unique_ptr<flutter::LayerTreeItem, std::_LIBCPP_ABI_NAMESPACE::default_delete<flutter::LayerTreeItem> >&&)
Flutter#flutter::Rasterizer::Draw(std::_LIBCPP_ABI_NAMESPACE::shared_ptr<flutter::Pipeline<flutter::LayerTreeItem> > const&, std::_LIBCPP_ABI_NAMESPACE::function<bool (flutter::LayerTree&)>)
Flutter#std::_LIBCPP_ABI_NAMESPACE::__function::__func<fml::internal::CopyableLambda<flutter::Shell::OnAnimatorDraw(std::_LIBCPP_ABI_NAMESPACE::shared_ptr<flutter::Pipeline<flutter::LayerTreeItem> >)::$_0>, std::_LIBCPP_ABI_NAMESPACE::allocator<fml::internal::CopyableLambda<flutter::Shell::OnAnimatorDraw(std::_LIBCPP_ABI_NAMESPACE::shared_ptr<flutter::Pipeline<flutter::LayerTreeItem> >)::$_0> >, void ()>::operator()()
Flutter#fml::MessageLoopImpl::FlushTasks(fml::FlushType)
Flutter#fml::MessageLoopDarwin::OnTimerFire(__CFRunLoopTimer*, fml::MessageLoopDarwin*)
CoreFoundation#__CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
CoreFoundation#__CFRunLoopDoTimer
CoreFoundation#__CFRunLoopDoTimers
CoreFoundation#__CFRunLoopRun
CoreFoundation#CFRunLoopRunSpecific
Flutter#fml::MessageLoopDarwin::Run()
Flutter#void* std::_LIBCPP_ABI_NAMESPACE::__thread_proxy[abi:v15000]<std::_LIBCPP_ABI_NAMESPACE::tuple<std::_LIBCPP_ABI_NAMESPACE::unique_ptr<std::_LIBCPP_ABI_NAMESPACE::__thread_struct, std::_LIBCPP_ABI_NAMESPACE::default_delete<std::_LIBCPP_ABI_NAMESPACE::__thread_struct> >, fml::Thread::Thread(std::_LIBCPP_ABI_NAMESPACE::function<void (fml::Thread::ThreadConfig const&)> const&, fml::Thread::ThreadConfig const&)::$_0> >(void*)
libsystem_pthread.dylib#_pthread_start

```

</details>


### Flutter Doctor output

<details><summary>Doctor output</summary>

```

Doctor summary (to see all details, run flutter doctor -v):
[!] Flutter (Channel unknown, 3.10.5, on macOS 13.4 22F66 darwin-arm64 (Rosetta), locale zh-Hans-CN)
    ! Flutter version 3.10.5 on channel unknown at /Users/mac/SDK/flutter
      Currently on an unknown channel. Run `flutter channel` to switch to an official channel.
      If that doesn't fix the issue, reinstall Flutter by following instructions at
      https://flutter.dev/docs/get-started/install.
    ! Unknown upstream repository.
      Reinstall Flutter by following instructions at https://flutter.dev/docs/get-started/install.
[!] Android toolchain - develop for Android devices (Android SDK version 33.0.0)
    ✗ cmdline-tools component is missing
      Run `path/to/sdkmanager --install "cmdline-tools;latest"`
      See https://developer.android.com/studio/command-line for more details.
    ✗ Android license status unknown.
      Run `flutter doctor --android-licenses` to accept the SDK licenses.
      See https://flutter.dev/docs/get-started/install/macos#android-setup for more details.
[✓] Xcode - develop for iOS and macOS (Xcode 14.0)
[✓] Chrome - develop for the web
[✓] Android Studio (version 2021.2)
[✓] VS Code (version 1.81.1)
[✓] Connected device (4 available)

```

</details>