[ Post-Tokyo: PJP provided the above wording. ]

Proposed resolution:

In [istream.formatted.arithmetic] Arithmetic Extractors, remove the two lines (1st and 3rd) which read:

operator>>(short& val);
...
operator>>(int& val);

And add the following at the end of that section (27.6.1.2.2) :

operator>>(short& val);

The conversion occurs as if performed by the following code fragment (using the same notation as for the preceding code fragment):

  typedef num_get< charT,istreambuf_iterator<charT,traits> > numget;
  iostate err = 0;
  long lval;
  use_facet< numget >(loc).get(*this, 0, *this, err, lval);
        if (err == 0
                && (lval < numeric_limits<short>::min() || numeric_limits<short>::max() < lval))
                err = ios_base::failbit;
  setstate(err);

operator>>(int& val);

The conversion occurs as if performed by the following code fragment (using the same notation as for the preceding code fragment):

  typedef num_get< charT,istreambuf_iterator<charT,traits> > numget;
  iostate err = 0;
  long lval;
  use_facet< numget >(loc).get(*this, 0, *this, err, lval);
        if (err == 0
                && (lval < numeric_limits<int>::min() || numeric_limits<int>::max() < lval))
                err = ios_base::failbit;
  setstate(err);

Formatted input is defined for the types short, unsigned short, int, unsigned int, long, unsigned long, float, double, long double, bool, and void*. According to section 27.6.1.2.2, formatted input of a value x is done as if by the following code fragment:

typedef num_get< charT,istreambuf_iterator<charT,traits> > numget; 
iostate err = 0; 
use_facet< numget >(loc).get(*this, 0, *this, err, val); 
setstate(err);

According to section [facet.num.get.members], however, num_get<>::get() is only overloaded for the types bool, long, unsigned short, unsigned int, unsigned long, unsigned long, float, double, long double, and void*. Comparing the lists from the two sections, we find that 27.6.1.2.2 is using a nonexistent function for types short and int.