CWG2861 dynamic_cast on bad pointer value

Author: burblebee

source/expressions.tex

@@ -1034,16 +1034,26 @@
 The pointer value\iref{basic.compound} is unchanged by this conversion.
 
 \pnum
-A prvalue of type ``pointer to \cv{} \tcode{D}'', where \tcode{D}
+A prvalue \tcode{v} of type ``pointer to \cv{} \tcode{D}'', where \tcode{D}
 is a complete class type, can be converted to a prvalue of type ``pointer to
 \cv{} \tcode{B}'', where \tcode{B} is a base class\iref{class.derived}
 of \tcode{D}. If \tcode{B} is an
 inaccessible\iref{class.access} or
 ambiguous\iref{class.member.lookup} base class of \tcode{D}, a program
-that necessitates this conversion is ill-formed. The result of the
-conversion is a pointer to the base class subobject of the derived class
-object. The null pointer value is converted to the null pointer value of
-the destination type.
+that necessitates this conversion is ill-formed.
+If \tcode{v} is a null pointer value,
+the result is a null pointer value.
+Otherwise,
+if \tcode{B} is a virtual base class of \tcode{D} and
+\tcode{v} does not point to an object
+whose type is similar\iref{conv.qual} to \tcode{D} and
+that is
+within its lifetime or
+within its period of construction or destruction\iref{class.cdtor},
+the behavior is undefined.
+Otherwise,
+the result is a pointer to the base class subobject of
+the derived class object.
 
 \rSec2[conv.mem]{Pointer-to-member conversions}
 
@@ -3861,6 +3871,22 @@
 \pnum
 If \tcode{v} is a null pointer value, the result is a null pointer value.
 
+\pnum
+If \tcode{v} has type ``pointer to \cv{}~\tcode{U}'' and
+\tcode{v} does not point to an object
+whose type is similar\iref{conv.qual} to \tcode{U} and
+that is
+within its lifetime or
+within its period of construction or destruction\iref{class.cdtor},
+the behavior is undefined.
+If \tcode{v} is a glvalue of type \tcode{U} and
+\tcode{v} does not refer to an object
+whose type is similar to \tcode{U} and
+that is
+within its lifetime or
+within its period of construction or destruction,
+the behavior is undefined.
+
 \pnum
 If \tcode{T} is ``pointer to \cv{} \keyword{void}'', then the result
 is a pointer to the most derived object pointed to by \tcode{v}.