diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index ae09cc1e27..0a3f85de16 100644
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,9 @@
+2013-02-14  Pedro Alves  <palves@redhat.com>
+
+	* eval.c (evaluate_subexp_for_address) <default_case_after_eval,
+	EVAL_AVOID_SIDE_EFFECTS>: Swap and handle TYPE_CODE_REF before
+	lval_memory.
+
 2013-02-14  Pedro Alves  <pedro@codesourcery.com>
 	    Hafiz Abid Qadeer  <abidh@codesourcery.com>
 
diff --git a/gdb/eval.c b/gdb/eval.c
index f4b39cbc2b..d7f80e2d4f 100644
--- a/gdb/eval.c
+++ b/gdb/eval.c
@@ -2929,12 +2929,12 @@ evaluate_subexp_for_address (struct expression *exp, int *pos,
 	{
 	  struct type *type = check_typedef (value_type (x));
 
-	  if (VALUE_LVAL (x) == lval_memory || value_must_coerce_to_target (x))
-	    return value_zero (lookup_pointer_type (value_type (x)),
-			       not_lval);
-	  else if (TYPE_CODE (type) == TYPE_CODE_REF)
+	  if (TYPE_CODE (type) == TYPE_CODE_REF)
 	    return value_zero (lookup_pointer_type (TYPE_TARGET_TYPE (type)),
 			       not_lval);
+	  else if (VALUE_LVAL (x) == lval_memory || value_must_coerce_to_target (x))
+	    return value_zero (lookup_pointer_type (value_type (x)),
+			       not_lval);
 	  else
 	    error (_("Attempt to take address of "
 		     "value not located in memory."));
diff --git a/gdb/testsuite/ChangeLog b/gdb/testsuite/ChangeLog
index 9a377259c0..c2affd18c3 100644
--- a/gdb/testsuite/ChangeLog
+++ b/gdb/testsuite/ChangeLog
@@ -1,3 +1,7 @@
+2013-02-14  Pedro Alves  <palves@redhat.com>
+
+	* gdb.cp/userdef.exp (ptype &*c): Don't expect an &.
+
 2013-02-14  Pedro Alves  <pedro@codesourcery.com>
 	    Hafiz Abid Qadeer  <abidh@codesourcery.com>
 
diff --git a/gdb/testsuite/gdb.cp/userdef.exp b/gdb/testsuite/gdb.cp/userdef.exp
index 7c20b33b7f..51a1bb5f67 100644
--- a/gdb/testsuite/gdb.cp/userdef.exp
+++ b/gdb/testsuite/gdb.cp/userdef.exp
@@ -133,7 +133,7 @@ gdb_test "break A2::operator +" ".*Breakpoint $decimal at.*"
 gdb_test "print c" "\\\$\[0-9\]* = {m = {z = .*}}"
 gdb_test "print *c" "\\\$\[0-9\]* = \\(Member &\\) @$hex: {z = .*}"
 gdb_test "print &*c" "\\\$\[0-9\]* = \\(Member \\*\\) $hex"
-gdb_test "ptype &*c" "type = (struct|class) Member {(\[\r\n \]+public:)?\[\r\n \]+int z;\[\r\n\].*} &\\*"
+gdb_test "ptype &*c" "type = (struct|class) Member {(\[\r\n \]+public:)?\[\r\n \]+int z;\[\r\n\].*} \\*"
 
 gdb_test "print operator== (mem1, mem2)" " = false"
 gdb_test "print operator== (mem1, mem1)" " = true"