asterisk users - Mar 2017 - Asterisk crash when playing a WAV file to G722 SIP

I recently upgraded to Asterisk 14.3.0.  When playing a SIP file to a
G722 SIP channel (via chan_sip), I get a crash with the following
traceback.  This is reproducable:

#0  0x00000036fdc30265 in raise () from /lib64/libc.so.6
#1  0x00000036fdc31d10 in abort () from /lib64/libc.so.6
#2  0x00000036fdc69beb in __libc_message () from /lib64/libc.so.6
#3  0x00000036fdc7174f in _int_free () from /lib64/libc.so.6
#4  0x00000036fdc75a4b in free () from /lib64/libc.so.6
#5  0x000000000050e19e in ast_frame_free (frame=0x5c35, cache=1) at frame.c:171
#6  0x0000000000502bac in ast_readaudio_callback (s=0x6a5df88) at file.c:921
#7  0x0000000000502d19 in ast_fsread_audio (data=0x5c35) at file.c:952
#8  0x00000000004bb3df in __ast_read (chan=0x7ba68f8, dropaudio=0)
    at channel.c:3848
#9  0x0000000000504e51 in waitstream_core (c=0x7ba68f8, 
    breakon=0x2b9630672bdb "", forward=0x5e56f8 "",
reverse=0x5e56f8 "",
    skip_ms=0, audiofd=-1, cmdfd=-1, context=0x0, cb=0) at file.c:1602
#10 0x00000000005053bf in ast_waitstream (c=0x5c35, 
    breakon=0x5fca <Address 0x5fca out of bounds>) at file.c:1754
#11 0x00002b963067272e in playback_exec (chan=0x7ba68f8, 

Does this "ring a bell" to anyone?  It looks like frame chainin has
gotten corrupted somehow, but this should be a straightforward case.