Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics

ReadChunk::commit and ReadChunk::commitall drop the committed elements before advancing the consumer head. If an element's Drop panics during the drop loop, head is never advanced, so the ring buffer still treats those slots as holding live elements. When the RingBuffer is later dropped it walks...