title: When is it valid to access a pointer to a "dead" object?
body: <p>First, to clarify, I am <strong>not</strong> talking about dereferencing invalid pointers!</p>
  
  <p>Consider the following two examples.</p>
  
  <p><strong>Example 1</strong></p>
  
  <pre><code>typedef struct { int *p; } T;
  
  T a = { malloc(sizeof(int) };
  free(a.p);  // a.p is now indeterminate?
  T b = a;    // Access through a non-character type?
  </code></pre>
  
  <p><strong>Example 2</strong></p>
  
  <pre><code>void foo(int *p) {}
  
  int *p = malloc(sizeof(int));
  free(p);   // p is now indeterminate?
  foo(p);    // Access through a non-character type?
  </code></pre>
  
  <p><strong>Question</strong></p>
  
  <p>Do either of the above examples invoke undefined behaviour?</p>
  
  <p><strong>Context</strong></p>
  
  <p>This question is posed in response to <a href="https://stackoverflow.com/questions/17019778/what-will-happen-if-a-stdvector-element-commits-suicide-using-delete-this/17019929#comment24597487_17019929">this discussion</a>.  The suggestion was that, for example, pointer arguments may be passed to a function via x86 segment registers, which could cause a hardware exception.</p>
  
  <p>From the C99 standard, we learn the following (emphasis mine):</p>
  
  <blockquote>
    <p><strong>[3.17]</strong> <em>indeterminate value</em> - either an unspecified value or a <strong>trap representation</strong></p>
  </blockquote>
  
  <p>and then:</p>
  
  <blockquote>
    <p><strong>[6.2.4 p2]</strong> The value of a pointer becomes <strong>indeterminate</strong> when
    the object it points to reaches the end of its lifetime.</p>
  </blockquote>
  
  <p>and then:</p>
  
  <blockquote>
    <p><strong>[6.2.6.1 p5]</strong> Certain object representations need not represent a value of the object type. If the stored value of an object has such a representation and is read by an lvalue expression that does not have character type, <strong>the behavior is undefined</strong>. If such a representation is produced by a side effect that modifies all or any part of the object by an lvalue expression that does not have character type, the behavior is undefined.  Such a representation is called a <strong>trap representation</strong>.</p>
  </blockquote>
  
  <p>Taking all of this together, what restrictions do we have on accessing pointers to "dead" objects?</p>
  
  <p><strong>Addendum</strong></p>
  
  <p>Whilst I've quoted the C99 standard above, I'd be interested to know if the behaviour differs in any of the C++ standards.</p>