diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 335085fa1a15..caf083ba5414 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,11 @@
+2006-08-22  Richard Guenther  <rguenther@suse.de>
+
+	PR middle-end/28776
+	* tree-scalar-evolution.c (fold_used_pointer): Add at_stmt
+	parameter.  Convert arguments to arithmetic expression to the
+	chrecs type.
+	(analyze_scalar_evolution_1): Adjust caller.
+
 2006-08-22  Jan Hubicka  <jh@suse.cz>
 
 	Patch by Paolo Bonzini
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index acdeb75b07c6..5c029fa566a6 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,9 @@
+2006-08-22  Richard Guenther  <rguenther@suse.de>
+
+	PR middle-end/28776
+	* gcc.c-torture/compile/pr28776-1.c: New testcase.
+	* gcc.c-torture/compile/pr28776-2.c: Likewise.
+
 2006-08-21  Mark Shinwell  <shinwell@codesourcery.com>
 
 	* g++.dg/eh/arm-vfp-unwind.C: Correct order of DejaGNU directives.
diff --git a/gcc/testsuite/gcc.c-torture/compile/pr28776-1.c b/gcc/testsuite/gcc.c-torture/compile/pr28776-1.c
new file mode 100644
index 000000000000..a37fb6fe105e
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/compile/pr28776-1.c
@@ -0,0 +1,16 @@
+typedef struct dw_fde_struct
+{
+  int decl;
+} *dw_fde_ref;
+dw_fde_ref fde_table;
+unsigned fde_table_in_use;
+void output_call_frame_info (void)
+{
+  unsigned int i;
+  dw_fde_ref fde;
+  for (i = 0; i < fde_table_in_use; i++)
+    {
+      fde = &fde_table[i];
+      tree_contains_struct_check_failed (fde_table[i].decl);
+    }
+}
diff --git a/gcc/testsuite/gcc.c-torture/compile/pr28776-2.c b/gcc/testsuite/gcc.c-torture/compile/pr28776-2.c
new file mode 100644
index 000000000000..61a5d37dfa95
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/compile/pr28776-2.c
@@ -0,0 +1,26 @@
+typedef struct RangeCoder
+{
+    unsigned char one_state[256];
+} RangeCoder;
+static inline void put_rac(RangeCoder *c, unsigned char* const state)
+{
+  *state= c->one_state[*state];
+}
+typedef struct PlaneContext{
+    unsigned (*state)[32];
+} PlaneContext;
+static inline void put_symbol(RangeCoder *c, unsigned char *state)
+{
+    int i;
+    const int e;
+    put_rac(c, state);
+    for(i=e-1; i>=0; i--)
+      put_rac(c, state+22+i);
+}
+int encode_line(void)
+{
+    PlaneContext * const p;
+    RangeCoder * const c;
+    int a;
+    put_symbol(c, p->state[a]);
+}
diff --git a/gcc/tree-scalar-evolution.c b/gcc/tree-scalar-evolution.c
index 13cbe42b55fd..9bd122adc47a 100644
--- a/gcc/tree-scalar-evolution.c
+++ b/gcc/tree-scalar-evolution.c
@@ -1765,7 +1765,8 @@ pointer_offset_p (tree expr)
 /* EXPR is a scalar evolution of a pointer that is dereferenced or used in
    comparison.  This means that it must point to a part of some object in
    memory, which enables us to argue about overflows and possibly simplify
-   the EXPR.  Returns the simplified value.
+   the EXPR.  AT_STMT is the statement in which this conversion has to be
+   performed.  Returns the simplified value.
 
    Currently, for
 
@@ -1820,7 +1821,7 @@ pointer_offset_p (tree expr)
    bugs.  */
 
 static tree
-fold_used_pointer (tree expr)
+fold_used_pointer (tree expr, tree at_stmt)
 {
   tree op0, op1, new0, new1;
   enum tree_code code = TREE_CODE (expr);
@@ -1833,13 +1834,13 @@ fold_used_pointer (tree expr)
 
       if (pointer_offset_p (op1))
 	{
-	  new0 = fold_used_pointer (op0);
+	  new0 = fold_used_pointer (op0, at_stmt);
 	  new1 = fold_used_pointer_cast (op1);
 	}
       else if (code == PLUS_EXPR && pointer_offset_p (op0))
 	{
 	  new0 = fold_used_pointer_cast (op0);
-	  new1 = fold_used_pointer (op1);
+	  new1 = fold_used_pointer (op1, at_stmt);
 	}
       else
 	return expr;
@@ -1847,6 +1848,9 @@ fold_used_pointer (tree expr)
       if (new0 == op0 && new1 == op1)
 	return expr;
 
+      new0 = chrec_convert (TREE_TYPE (expr), new0, at_stmt);
+      new1 = chrec_convert (TREE_TYPE (expr), new1, at_stmt);
+
       if (code == PLUS_EXPR)
 	expr = chrec_fold_plus (TREE_TYPE (expr), new0, new1);
       else
@@ -1948,7 +1952,7 @@ analyze_scalar_evolution_1 (struct loop *loop, tree var, tree res)
       if (POINTER_TYPE_P (type)
 	  && !automatically_generated_chrec_p (res)
 	  && pointer_used_p (var))
-	res = fold_used_pointer (res);
+	res = fold_used_pointer (res, def);
       break;
 
     case PHI_NODE: