Repository: flutter
Issue: iOS Impeller crash : impeller::RenderPassMTL::Draw() EXC_BAD_ACCESS (KERN_INVALID_ADDRESS)
Labels: c: crash,platform-ios,a: production,P2,needs repro info,e: impeller,team-engine,triaged-engine

### Steps to reproduce

I have a new crash in my live app due to impeller on iOS. 
I have never encountered it in debug mode neither in release mode myself, it's a live user that has got this crash.
Here is the full [trace](https://github.com/user-attachments/files/18095018/stack.txt)

### Expected results

The app should not crash

### Actual results

The app is crashing

### Code sample

<details open><summary>Code sample</summary>

```dart
[Paste your code here]
```

</details>


### Screenshots or Video

<details open>
<summary>Screenshots / Video demonstration</summary>

[Upload media here]

</details>


### Logs

<details open><summary>Logs</summary>

```console
Crashed: io.flutter.1.raster
0  Metal                          0x1bc4 MTLResourceListAddResource + 64
1  AGXMetalG14                    0x6a0c28 <redacted> + 144
2  AGXMetalG14                    0x36cb9c <redacted> + 248
3  AGXMetalG14                    0x376470 <redacted> + 420
4  Flutter                        0x49b6cc impeller::RenderPassMTL::Draw() + 343 (render_pass_mtl.mm:343)
5  Flutter                        0x161b04 impeller::SolidColorContents::Render(impeller::ContentContext const&, impeller::Entity const&, impeller::RenderPass&) const + 72 (status.h:72)
6  Flutter                        0x13eefc std::_fl::__function::__func<impeller::Contents::RenderToSnapshot(impeller::ContentContext const&, impeller::Entity const&, std::_fl::optional<impeller::TRect<float>>, std::_fl::optional<impeller::SamplerDescriptor> const&, bool, int, std::_fl::basic_string<char, std::_fl::char_traits<char>, std::_fl::allocator<char>> const&) const::$_0, std::_fl::allocator<impeller::Contents::RenderToSnapshot(impeller::ContentContext const&, impeller::Entity const&, std::_fl::optional<impeller::TRect<float>>, std::_fl::optional<impeller::SamplerDescriptor> const&, bool, int, std::_fl::basic_string<char, std::_fl::char_traits<char>, std::_fl::allocator<char>> const&) const::$_0>, bool (impeller::ContentContext const&, impeller::RenderPass&)>::operator()(impeller::ContentContext const&, impeller::RenderPass&) + 105 (contents.cc:105)
7  Flutter                        0x13dea4 impeller::ContentContext::MakeSubpass(std::_fl::basic_string_view<char, std::_fl::char_traits<char>>, impeller::RenderTarget const&, std::_fl::shared_ptr<impeller::CommandBuffer> const&, std::_fl::function<bool (impeller::ContentContext const&, impeller::RenderPass&)> const&) const + 522 (content_context.cc:522)
8  Flutter                        0x13dd54 impeller::ContentContext::MakeSubpass(std::_fl::basic_string_view<char, std::_fl::char_traits<char>>, impeller::TSize<long long>, std::_fl::shared_ptr<impeller::CommandBuffer> const&, std::_fl::function<bool (impeller::ContentContext const&, impeller::RenderPass&)> const&, bool, bool, int) const + 21 (render_target.cc:21)
9  Flutter                        0x13e844 impeller::Contents::RenderToSnapshot(impeller::ContentContext const&, impeller::Entity const&, std::_fl::optional<impeller::TRect<float>>, std::_fl::optional<impeller::SamplerDescriptor> const&, bool, int, std::_fl::basic_string<char, std::_fl::char_traits<char>, std::_fl::allocator<char>> const&) const + 470 (function.h:470)
10 Flutter                        0x151cbc impeller::ContentsFilterInput::GetSnapshot(std::_fl::basic_string<char, std::_fl::char_traits<char>, std::_fl::allocator<char>> const&, impeller::ContentContext const&, impeller::Entity const&, std::_fl::optional<impeller::TRect<float>>, int) const + 33 (contents_filter_input.cc:33)
11 Flutter                        0x14d41c impeller::GaussianBlurFilterContents::RenderFilter(std::_fl::vector<std::_fl::shared_ptr<impeller::FilterInput>, std::_fl::allocator<std::_fl::shared_ptr<impeller::FilterInput>>> const&, impeller::ContentContext const&, impeller::Entity const&, impeller::Matrix const&, impeller::TRect<float> const&, std::_fl::optional<impeller::TRect<float>> const&) const + 1498 (string:1498)
12 Flutter                        0x14c834 impeller::FilterContents::GetEntity(impeller::ContentContext const&, impeller::Entity const&, std::_fl::optional<impeller::TRect<float>> const&) const + 238 (filter_contents.cc:238)
13 Flutter                        0x14c310 impeller::FilterContents::Render(impeller::ContentContext const&, impeller::Entity const&, impeller::RenderPass&) const + 344 (optional:344)
14 Flutter                        0x170054 impeller::EntityPass::RenderElement(impeller::Entity&, unsigned long, impeller::InlinePassContext&, int, impeller::ContentContext&, impeller::EntityPassClipStack&, impeller::TPoint<float>) const + 832 (entity_pass.cc:832)
15 Flutter                        0x16f120 impeller::EntityPass::OnRender(impeller::ContentContext&, impeller::TSize<long long>, impeller::EntityPassTarget&, impeller::TPoint<float>, impeller::TPoint<float>, unsigned int, impeller::EntityPassClipStack&, unsigned long, std::_fl::shared_ptr<impeller::Contents>, std::_fl::optional<impeller::InlinePassContext::RenderPassResult> const&) const + 984 (entity_pass.cc:984)
16 Flutter                        0x111d34 impeller::AiksContext::Render(impeller::Picture const&, impeller::RenderTarget&, bool) + 501 (entity_pass.cc:501)
17 Flutter                        0x17f454 impeller::Renderer::Render(std::_fl::unique_ptr<impeller::Surface, std::_fl::default_delete<impeller::Surface>>, std::_fl::function<bool (impeller::RenderTarget&)> const&) const + 46 (renderer.cc:46)
18 Flutter                        0x5f6ca8 std::_fl::__function::__func<fml::internal::CopyableLambda<flutter::GPUSurfaceMetalImpeller::AcquireFrameFromCAMetalLayer(SkISize const&)::$_0>, std::_fl::allocator<fml::internal::CopyableLambda<flutter::GPUSurfaceMetalImpeller::AcquireFrameFromCAMetalLayer(SkISize const&)::$_0>>, bool (flutter::SurfaceFrame&, flutter::DlCanvas*)>::operator()(flutter::SurfaceFrame&, flutter::DlCanvas*&&) + 191 (gpu_surface_metal_impeller.mm:191)
19 Flutter                        0x4f432c flutter::SurfaceFrame::Submit() + 56 (surface_frame.cc:56)
20 Flutter                        0x5aa3b4 flutter::Rasterizer::DrawToSurfacesUnsafe(flutter::FrameTimingsRecorder&, std::_fl::vector<std::_fl::unique_ptr<flutter::LayerTreeTask, std::_fl::default_delete<flutter::LayerTreeTask>>, std::_fl::allocator<std::_fl::unique_ptr<flutter::LayerTreeTask, std::_fl::default_delete<flutter::LayerTreeTask>>>>) + 803 (rasterizer.cc:803)
21 Flutter                        0x5aa8a0 std::_fl::__function::__func<flutter::Rasterizer::DrawToSurfaces(flutter::FrameTimingsRecorder&, std::_fl::vector<std::_fl::unique_ptr<flutter::LayerTreeTask, std::_fl::default_delete<flutter::LayerTreeTask>>, std::_fl::allocator<std::_fl::unique_ptr<flutter::LayerTreeTask, std::_fl::default_delete<flutter::LayerTreeTask>>>>)::$_1, std::_fl::allocator<flutter::Rasterizer::DrawToSurfaces(flutter::FrameTimingsRecorder&, std::_fl::vector<std::_fl::unique_ptr<flutter::LayerTreeTask, std::_fl::default_delete<flutter::LayerTreeTask>>, std::_fl::allocator<std::_fl::unique_ptr<flutter::LayerTreeTask, std::_fl::default_delete<flutter::LayerTreeTask>>>>)::$_1>, void ()>::operator()() + 597 (rasterizer.cc:597)
22 Flutter                        0x802a8 fml::SyncSwitch::Execute(fml::SyncSwitch::Handlers const&) const + 29 (shared_mutex.h:29)
23 Flutter                        0x5a9ae4 flutter::Rasterizer::DrawToSurfaces(flutter::FrameTimingsRecorder&, std::_fl::vector<std::_fl::unique_ptr<flutter::LayerTreeTask, std::_fl::default_delete<flutter::LayerTreeTask>>, std::_fl::allocator<std::_fl::unique_ptr<flutter::LayerTreeTask, std::_fl::default_delete<flutter::LayerTreeTask>>>>) + 470 (function.h:470)
24 Flutter                        0x5ab720 std::_fl::__function::__func<flutter::Rasterizer::Draw(std::_fl::shared_ptr<flutter::Pipeline<flutter::FrameItem>> const&)::$_0, std::_fl::allocator<flutter::Rasterizer::Draw(std::_fl::shared_ptr<flutter::Pipeline<flutter::FrameItem>> const&)::$_0>, void (std::_fl::unique_ptr<flutter::FrameItem, std::_fl::default_delete<flutter::FrameItem>>)>::operator()(std::_fl::unique_ptr<flutter::FrameItem, std::_fl::default_delete<flutter::FrameItem>>&&) + 423 (vector:423)
25 Flutter                        0x5aaf3c flutter::Rasterizer::Draw(std::_fl::shared_ptr<flutter::Pipeline<flutter::FrameItem>> const&) + 259 (unique_ptr.h:259)
26 Flutter                        0x5c27c0 std::_fl::__function::__func<fml::internal::CopyableLambda<flutter::Shell::OnAnimatorDraw(std::_fl::shared_ptr<flutter::Pipeline<flutter::FrameItem>>)::$_0>, std::_fl::allocator<fml::internal::CopyableLambda<flutter::Shell::OnAnimatorDraw(std::_fl::shared_ptr<flutter::Pipeline<flutter::FrameItem>>)::$_0>>, void ()>::operator()() + 1290 (shell.cc:1290)
27 Flutter                        0x7e858 fml::MessageLoopImpl::FlushTasks(fml::FlushType) + 128 (message_loop_impl.cc:128)
28 Flutter                        0x81e5c fml::MessageLoopDarwin::OnTimerFire(__CFRunLoopTimer*, fml::MessageLoopDarwin*) + 86 (message_loop_darwin.mm:86)
29 CoreFoundation                 0xb4894 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 32
30 CoreFoundation                 0xb4538 __CFRunLoopDoTimer + 1012
31 CoreFoundation                 0xb408c __CFRunLoopDoTimers + 288
32 CoreFoundation                 0x533b4 __CFRunLoopRun + 1856
33 CoreFoundation                 0x52830 CFRunLoopRunSpecific + 588
34 Flutter                        0x81f48 fml::MessageLoopDarwin::Run() + 52 (message_loop_darwin.mm:52)
35 Flutter                        0x81b90 std::_fl::__function::__func<fml::Thread::Thread(std::_fl::function<void (fml::Thread::ThreadConfig const&)> const&, fml::Thread::ThreadConfig const&)::$_0, std::_fl::allocator<fml::Thread::Thread(std::_fl::function<void (fml::Thread::ThreadConfig const&)> const&, fml::Thread::ThreadConfig const&)::$_0>, void ()>::operator()() + 94 (message_loop_impl.cc:94)
36 Flutter                        0x81820 fml::ThreadHandle::ThreadHandle(std::_fl::function<void ()>&&)::$_0::__invoke(void*) + 470 (function.h:470)
37 libsystem_pthread.dylib        0x637c _pthread_start + 136
38 libsystem_pthread.dylib        0x1494 thread_start + 8
```

</details>


### Flutter Doctor output

<details open><summary>Doctor output</summary>

```console
[✓] Flutter (Channel stable, 3.24.5, on macOS 15.1.1 24B91 darwin-x64, locale fr-FR)
    • Flutter version 3.24.5 on channel stable at /Users/foxtom/Desktop/flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision dec2ee5c1f (4 weeks ago), 2024-11-13 11:13:06 -0800
    • Engine revision a18df97ca5
    • Dart version 3.5.4
    • DevTools version 2.37.3

[✓] Android toolchain - develop for Android devices (Android SDK version 35.0.0)
    • Android SDK at /Users/foxtom/Library/Android/sdk
    • Platform android-35, build-tools 35.0.0
    • Java binary at: /Applications/Android Studio.app/Contents/jbr/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build 21.0.3+-79915915-b509.11)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 16.1)
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Build 16B40
    • CocoaPods version 1.16.2

[✓] Chrome - develop for the web
    • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 2024.2)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
      🔨 https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 21.0.3+-79915915-b509.11)

[✓] VS Code (version 1.95.3)
    • VS Code at /Applications/Visual Studio Code.app/Contents
    • Flutter extension can be installed from:
      🔨 https://marketplace.visualstudio.com/items?itemName=Dart-Code.flutter

[✓] Connected device (4 available)
    • Now You See Me (mobile) • 00008020-001204401E78002E • ios            • iOS 18.1.1 22B91
    • macOS (desktop)         • macos                     • darwin-x64     • macOS 15.1.1 24B91 darwin-x64
    • Chrome (web)            • chrome                    • web-javascript • Google Chrome 131.0.6778.110

[✓] Network resources
    • All expected network resources are available.

• No issues found!
```

</details>