diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index fcaf921c281..e18dfd6f4b6 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,8 @@
+2007-01-13  Zdenek Dvorak <dvorakz@suse.cz>
+
+	* ipa-reference.c (analyze_function): Consider also addresses taken
+	in phi nodes.
+
 2007-01-12  Roger Sayle  <roger@eyesopen.com>
 
 	* c-typeck.c (null_pointer_constant_p): Replace use of
diff --git a/gcc/ipa-reference.c b/gcc/ipa-reference.c
index 8602afda0b0..b1ff849082e 100644
--- a/gcc/ipa-reference.c
+++ b/gcc/ipa-reference.c
@@ -807,6 +807,21 @@ analyze_function (struct cgraph_node *fn)
     FOR_EACH_BB_FN (this_block, this_cfun)
       {
 	block_stmt_iterator bsi;
+	tree phi, op;
+	use_operand_p use;
+	ssa_op_iter iter;
+
+	/* Find the addresses taken in phi node arguments.  */
+	for (phi = phi_nodes (this_block); phi; phi = PHI_CHAIN (phi))
+	  {
+	    FOR_EACH_PHI_ARG (use, phi, iter, SSA_OP_USE)
+	      {
+		op = USE_FROM_PTR (use);
+		if (TREE_CODE (op) == ADDR_EXPR)
+		  check_rhs_var (l, op);
+	      }
+	  }
+
 	for (bsi = bsi_start (this_block); !bsi_end_p (bsi); bsi_next (&bsi))
 	  walk_tree (bsi_stmt_ptr (bsi), scan_for_static_refs, 
 		     fn, visited_nodes);
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 41ebdf22570..7c3b7698730 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,7 @@
+2007-01-13  Zdenek Dvorak <dvorakz@suse.cz>
+
+	* gcc.dg/20070112-1.c: New test.
+
 2007-01-12  Jerry DeLisle  <jvdelisle@gcc.gnu.org>
 
 	PR libgfortran/30435
@@ -5,7 +9,7 @@
 
 2007-01-12  Olga Golovanevsky  <olga@il.ibm.com>
 
-        * gcc.dg/torture/pr24750-1.c:  Add prototype of free.
+	* gcc.dg/torture/pr24750-1.c:  Add prototype of free.
 
 2007-01-12  Tom Tromey  <tromey@redhat.com>
 
diff --git a/gcc/testsuite/gcc.dg/20070112-1.c b/gcc/testsuite/gcc.dg/20070112-1.c
new file mode 100644
index 00000000000..bd783356764
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/20070112-1.c
@@ -0,0 +1,24 @@
+/* We used to ICE on this testcase: the address of bad_spill_regs is
+   only taken in a phi node, which we missed and cleared its TREE_ADDRESSABLE
+   flag.  This gets revealed when the loop is completely unrolled, thus
+   exposing the addresses as ordinary statements.  */
+
+/* { dg-do compile } */
+/* { dg-options "-O1" } */
+
+
+typedef unsigned HARD_REG_SET[2];
+static HARD_REG_SET bad_spill_regs;
+
+void
+order_regs_for_reload ()
+{
+  register int i;
+
+  register unsigned *scan_tp_ = bad_spill_regs;
+
+  for (i = 0; i < 2; i++)
+    *scan_tp_++ = 0;
+
+  bad_spill_regs[0] |= 1;
+}