diff --git a/gcc/cp/ChangeLog b/gcc/cp/ChangeLog
index 22dbdba6936..91241779462 100644
--- a/gcc/cp/ChangeLog
+++ b/gcc/cp/ChangeLog
@@ -1,3 +1,10 @@
+2006-08-22  Simon Martin  <simartin@users.sourceforge.net>
+
+	PR c++/28420
+	* parser.c (cp_parser_postfix_expression): Make sure that the
+	saved value for parser->type_definition_forbidden_message is
+	restored before returning to avoid an invalid free().
+
 2006-08-22  Jason Merrill  <jason@redhat.com>
 
 	PR c++/28659
diff --git a/gcc/cp/parser.c b/gcc/cp/parser.c
index d015ae1d7a1..729d0ca488c 100644
--- a/gcc/cp/parser.c
+++ b/gcc/cp/parser.c
@@ -4076,12 +4076,12 @@ cp_parser_postfix_expression (cp_parser *parser, bool address_p, bool cast_p)
 	    /* Look for the `)' token.  */
 	    cp_parser_require (parser, CPP_CLOSE_PAREN, "`)'");
 	  }
+	/* Restore the saved message.  */
+	parser->type_definition_forbidden_message = saved_message;
 	/* `typeid' may not appear in an integral constant expression.  */
 	if (cp_parser_non_integral_constant_expression(parser,
 						       "`typeid' operator"))
 	  return error_mark_node;
-	/* Restore the saved message.  */
-	parser->type_definition_forbidden_message = saved_message;
       }
       break;
 
diff --git a/gcc/testsuite/g++.dg/template/typeid-template-argument.C b/gcc/testsuite/g++.dg/template/typeid-template-argument.C
new file mode 100644
index 00000000000..38dbfd3f3e3
--- /dev/null
+++ b/gcc/testsuite/g++.dg/template/typeid-template-argument.C
@@ -0,0 +1,7 @@
+// This used to ICE (PR28420)
+
+// { dg-do compile }
+
+template<int> struct A;
+
+int i = sizeof(A<typeid>); // { dg-error "operator cannot appear in a constant-expression|template argument 1 is invalid" }