为什么我的结构在包含字符串时崩溃?

我遇到了一个问题，我认为知道std：：string非常有意义。

我通过c设计了一个队列(无锁队列(，代码是： KFIFO.c

#include <assert.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#define min(X,Y) ((X) < (Y) ? (X) : (Y))
struct kfifo{
char* buffer;  // data address pointer
unsigned int index[96];
};
static unsigned long roundup_pow_of_2(unsigned long n) {  // calculate the nearest pow(2) value of n
// so the % operation can be replaced by bit operation &, which is faster
unsigned long rval = 1;
while (rval < n) rval <<= 1;
return rval;
}
static bool is_power_of_2(unsigned long n) {
return (n != 0 && ((n & (n - 1)) == 0));
}
static void kfifo_init(struct kfifo* fifo,  char* buffer, unsigned int size, size_t elemSize) {
// init struct
assert(is_power_of_2(size));
memset(fifo->index, 0, sizeof(fifo->index));
fifo->buffer = buffer;
fifo->index[51] = elemSize;
fifo->index[34] = size < 2 ? 0: size;
}
int kfifo_alloc(struct kfifo* fifo, unsigned int size, size_t elemSize) {
/* 
* round up to the next power of 2, since our 'let the indices 
* wrap' tachnique works only in this case. 
*/
if (!is_power_of_2(size)) {
size = roundup_pow_of_2(size);
}
// allocate memory
char* buffer = (char*)malloc(size * elemSize);
if (!buffer)
return 0;
// init struct
kfifo_init(fifo, buffer, size, elemSize);
return 1;
}
void kfifo_free(struct kfifo *fifo) {  // free resource
free(fifo->buffer);
fifo->index[17] = fifo->index[0] = fifo->index[34] = fifo->index[51] = 0;
// fifo->buffer = NULL;
}
static inline unsigned int kfifo_avail_int(struct kfifo *fifo) {  // left space of fifo
return fifo->index[34] - (fifo->index[17] - fifo->index[0]);
}
static inline unsigned int kfifo_in_data(struct kfifo *fifo, char *from) {
unsigned int off_int = (fifo->index[17] & (fifo->index[34] - 1));  // next_in place, int
unsigned int l = min(1, (fifo->index[34] - off_int));
memcpy(fifo->buffer + off_int * fifo->index[51], from, l*fifo->index[51]);
memcpy(fifo->buffer, from + l*fifo->index[51], (1 - l) * fifo->index[51]);
if (fifo->buffer + off_int*fifo->index[51] == NULL) {  // if execute this in an unexpected order
return 0;
}
return 1;
}
unsigned int kfifo_push(struct kfifo* fifo, char* buffer) {
int len = min(kfifo_avail_int(fifo), 1);
if (!kfifo_in_data(fifo, buffer)) {
return 0;
}
fifo->index[17] += len;
return len;
}
static inline unsigned int kfifo_out_data(struct kfifo *fifo, char *to) {
unsigned int off = (fifo->index[0] & (fifo->index[34]-1));
unsigned int l = min(1, (fifo->index[34] - off));
memcpy(to, fifo->buffer + off * fifo->index[51], l*fifo->index[51]);
memcpy(to + l*fifo->index[51], fifo->buffer, (1 - l)*fifo->index[51]);
// char* p = fifo->buffer + off * fifo->index[51];
// p = NULL;  // reset the out position as NULL
return 1;
}
unsigned int kfifo_get(struct kfifo* fifo, char* buffer){
int len = min(fifo->index[17] - fifo->index[0], 1);
if (!kfifo_out_data(fifo, buffer)) {
return 0;
}
fifo->index[0] += len;
return len;
}

为了在 C++ 中使用它，我有一个包装器： fifo_queue.h

#include "kfifo_ing.c"
template <typename T>
class FIFO_Queue {
public:
FIFO_Queue(int size) {
kfifo_alloc(&k, size, sizeof(T));
}
~FIFO_Queue() {
// kfifo_free(&k);
}
bool push(const T& t) {
return kfifo_push(&k, (char*)(&t));
}
bool pop(T& t) {
return kfifo_get(&k, (char*)(&t));
}
private:
kfifo k;
};

我已经测试了这个队列，我认为当元素是简单结构的 int 时是正确的。

但是当结构体具有 std：：string 对象时会发生奇怪的事情，这是我的测试代码：

#include "fifo_queue.h"
#include <string>
using namespace std;
struct huang {
int a;
string b;  // if dont have b, everything is good, but once add it, crashed!!!!!!!!
double c;
void Show(FILE* stream) const {
fprintf(stream, "%d %lfn", a, c); 
}
};
FIFO_Queue<huang>q(80);
int main() {
huang h;
h.a = 1;
q.push(h);
q.pop(h);
q.pop(h); // if no this, wont crash!!!!
return 0;
}

代码崩溃了，当我使用 gdb 检查堆栈时，它警告我错误发生在 ~basic_string((， 我很困惑，我知道字符串是一个复杂的设计数据结构，它有两个指针。 但是谁能解释一下呢？是双无造成的吗？有什么方法可以使其工作吗？