diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 2348ecc9843..4ba02e47fcb 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,8 @@
+2007-10-15  Jakub Jelinek  <jakub@redhat.com>
+
+	PR tree-optimization/33136
+	* opts.c (decode_options): Don't enable flag_ipa_type_escape.
+
 2007-10-15  Alexandre Oliva  <aoliva@redhat.com>
 
 	PR tree-optimization/33735
diff --git a/gcc/opts.c b/gcc/opts.c
index 4472cbe328c..f93c746bd97 100644
--- a/gcc/opts.c
+++ b/gcc/opts.c
@@ -830,7 +830,6 @@ decode_options (unsigned int argc, const char **argv)
       flag_cse_follow_jumps = 1;
       flag_gcse = 1;
       flag_expensive_optimizations = 1;
-      flag_ipa_type_escape = 1;
       flag_rerun_cse_after_loop = 1;
       flag_caller_saves = 1;
       flag_peephole2 = 1;
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 12b8cba6cb2..63f57c486d1 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,11 @@
+2007-10-15  Jakub Jelinek  <jakub@redhat.com>
+
+	PR tree-optimization/33136
+	* gcc.c-torture/execute/20070824-1.c: New test.
+	* gcc.dg/pr33136-1.c: New test.
+	* gcc.dg/pr33136-2.c: New test.
+	* gcc.dg/pr33136-3.c: New test.
+
 2007-10-15  Alexandre Oliva  <aoliva@redhat.com>
 
 	PR tree-optimization/33735
diff --git a/gcc/testsuite/gcc.c-torture/execute/20070824-1.c b/gcc/testsuite/gcc.c-torture/execute/20070824-1.c
new file mode 100644
index 00000000000..74eb58c05b9
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/execute/20070824-1.c
@@ -0,0 +1,24 @@
+/* PR tree-optimization/33136 */
+
+extern void abort (void);
+
+struct S
+{
+  struct S *a;
+  int b;
+};
+
+int
+main (void)
+{
+  struct S *s = (struct S *) 0, **p, *n;
+  for (p = &s; *p; p = &(*p)->a);
+  n = (struct S *) __builtin_alloca (sizeof (*n));
+  n->a = *p;
+  n->b = 1;
+  *p = n;
+
+  if (!s)
+    abort ();
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/pr33136-1.c b/gcc/testsuite/gcc.dg/pr33136-1.c
new file mode 100644
index 00000000000..d07c97eb7e9
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr33136-1.c
@@ -0,0 +1,54 @@
+/* PR tree-optimization/33136 */
+/* { dg-do run } */
+/* { dg-options "-O2" } */
+
+extern void abort (void);
+
+struct S
+{
+  struct S *a;
+  int b;
+  float f;
+};
+
+static struct S s;
+
+static int *
+__attribute__((noinline, const))
+foo (void)
+{
+  return &s.b;
+}
+
+float
+__attribute__((noinline))
+bar (float *f)
+{
+  s.f = 1.0;
+  *f = 4.0;
+  return s.f;
+}
+
+int
+__attribute__((noinline))
+baz (int *x)
+{
+  s.b = 1;
+  *x = 4;
+  return s.b;
+}
+
+int
+t (void)
+{
+  float f = 8.0;
+  return bar (&f) + baz (foo ());
+}
+
+int
+main (void)
+{
+  if (t () != 5)
+    abort ();
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/pr33136-2.c b/gcc/testsuite/gcc.dg/pr33136-2.c
new file mode 100644
index 00000000000..760b5a06fdd
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr33136-2.c
@@ -0,0 +1,60 @@
+/* PR tree-optimization/33136 */
+/* { dg-do run } */
+/* { dg-options "-O2" } */
+
+extern void abort (void);
+
+struct S
+{
+  void *a;
+  int b;
+  int *c;
+};
+static int d, e;
+
+static struct S s;
+
+static int *
+__attribute__((noinline, const))
+foo (void)
+{
+  return &s.b;
+}
+
+int *
+__attribute__((noinline))
+bar (int **f)
+{
+  s.c = &d;
+  *f = &e;
+  /* As nothing ever takes the address of any int * field in struct S,
+     the write to *f can't alias with the s.c field.  */
+  return s.c;
+}
+
+int
+__attribute__((noinline))
+baz (int *x)
+{
+  s.b = 1;
+  *x = 4;
+  /* Function foo takes address of an int field in struct S,
+     so *x can alias with the s.b field (and it does in this testcase).  */
+  return s.b;
+}
+
+int
+__attribute__((noinline))
+t (void)
+{
+  int *f = (int *) 0;
+  return 10 * (bar (&f) != &d) + baz (foo ());
+}
+
+int
+main (void)
+{
+  if (t () != 4)
+    abort ();
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/pr33136-3.c b/gcc/testsuite/gcc.dg/pr33136-3.c
new file mode 100644
index 00000000000..fcb5972ebf0
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr33136-3.c
@@ -0,0 +1,60 @@
+/* PR tree-optimization/33136 */
+/* { dg-do run } */
+/* { dg-options "-O2" } */
+
+extern void abort (void);
+
+struct S
+{
+  void *a;
+  int b[3];
+  double *c;
+};
+static double d, e;
+
+static struct S s;
+
+static int *
+__attribute__((noinline, const))
+foo (void)
+{
+  return (int *) &s.b;
+}
+
+double *
+__attribute__((noinline))
+bar (double **f)
+{
+  s.c = &d;
+  *f = &e;
+  /* As nothing ever takes the address of any double * field in struct S,
+     the write to *f can't alias with the s.c field.  */
+  return s.c;
+}
+
+int
+__attribute__((noinline))
+baz (int *x)
+{
+  s.b[0] = 1;
+  *x = 4;
+  /* Function foo takes address of an int array field in struct S,
+     so *x can alias with the s.b field (and it does in this testcase).  */
+  return s.b[0];
+}
+
+int
+__attribute__((noinline))
+t (void)
+{
+  double *f = (double *) 0;
+  return 10 * (bar (&f) != &d) + baz (foo ());
+}
+
+int
+main (void)
+{
+  if (t () != 4)
+    abort ();
+  return 0;
+}