Opus 1.3.1 crashes on iOS 18.

This stack trace looks strange.

Crashed：AURemoteIO::IOThread 
SIGABRT ABORT 0x00000001d42e51d4

0 libsystem_kernel.dylib __pthread_kill + 8
1 libsystem_pthread.dylib pthread_kill + 268
2 libsystem_c.dylib abort + 128
3 TestApp comb_filter + 648012
4 TestApp opus_decoder_destroy + 869644
5 TestApp codecopus.cpp - 第 121 行    CodecOpus::OpusToPcm(unsigned char*, unsigned int, unsigned short*, unsigned int) + 121

This is my decoded code

int32_t CodecOpus::OpusToPcm(uint8_t * bufferOpus, uint32_t opusSize, uint16_t * bufferPcm, uint32_t pcmSize)
{
	int usingFec = 0;
	uint8_t* inputBuffer = bufferOpus;
	int32_t inputSize = opusSize;

    int32_t outputSamples = pcmSize / (2 * _channelCount);
	if (_lastFrameSize != 0) {
		usingFec = 0;
		inputBuffer = _lastFrameBuffer;
		inputSize = _lastFrameSize;
	} else { // last frame has lost
		usingFec = 1; // use current frame to recover last frame(using fec)
		outputSamples = _samplesPerFrame;
	}
	int32_t decodeResult = opus_decode(_decState, (const uint8_t *)inputBuffer, inputSize, (int16_t *)bufferPcm, outputSamples, usingFec);
	if (bufferOpus != NULL && opusSize <= kOpusMaxFrameSize && opusSize > 0) {
		memcpy(_lastFrameBuffer, bufferOpus, opusSize);
		_lastFrameSize = opusSize;
	} else {
		_lastFrameSize = 0;
	}

	if (decodeResult > 0) {
		return decodeResult * 2 * _channelCount;
	}
	return decodeResult;
}

Start at codecopus.cpp line 121 and trace the opus_decode call through the supplied iOS 18 stack trace, including opus_decoder_destroy and comb_filter. Reproduce the crash on iOS 18 using the shown decoding path. Done means the crash cause is isolated and the decoding path no longer crashes.