How to use std::num_get<> in self-defined istream?

I wrote a istream for bits. When I wanted to implement formatted input, I copied the implementation of _Common_extract_with_num_get and istreambuf_iterator from msvc for experiment, here is part of relevant code:

using numget = std::num_get<char, ibstreambuf_iterator<char>>;
...

template <class _Ty>    
basic_ibstream& _Common_extract_with_num_get(_Ty& _Val) { // formatted extract with num_get     
    bios::iostate _Err = bios::goodbit;     
    const sentry _Ok(*this);        
    if (_Ok)    
        _STD use_facet<numget>(this->getloc()).get(*this, {}, *this, _Err, _Val);       
    _Base::setstate(_Err);      
    return *this;   
}

but when _Ty is bool, a breakpoint is triggered.

(*Exception thrown at 0x79324630 (msvcp140d.dll) in xstl.exe: 0xC0000005: Access violation reading location 0x00000004.*)

when _Ty is not bool, complier shows

'_InIt std::num_get<char,_InIt>::get(_InIt,_InIt,std::ios_base &,std::ios_base::iostate &,bool &) const': 
   cannot convert argument 5 from '_Ty' to 'bool &'