diff --git a/lib/StaticAnalyzer/Core/SValBuilder.cpp b/lib/StaticAnalyzer/Core/SValBuilder.cpp
index d005c2a..765ae48 100644
--- a/lib/StaticAnalyzer/Core/SValBuilder.cpp
+++ b/lib/StaticAnalyzer/Core/SValBuilder.cpp
@@ -325,7 +325,7 @@
 
     // Are we casting from an array to a pointer?  If so just pass on
     // the decayed value.
-    if (castTy->isPointerType())
+    if (castTy->isPointerType() || castTy->isReferenceType())
       return val;
 
     // Are we casting from an array to an integer?  If so, cast the decayed
diff --git a/test/Analysis/cxx11-crashes.cpp b/test/Analysis/cxx11-crashes.cpp
index 2dc9b55..8c68734 100644
--- a/test/Analysis/cxx11-crashes.cpp
+++ b/test/Analysis/cxx11-crashes.cpp
@@ -36,3 +36,24 @@
 void testFloatInitializer() {
   const float ysize={0.015}, xsize={0.01};
 }
+
+
+// PR12874, radar://11487525
+template<class T> struct addr_impl_ref {
+  T & v_;
+  inline addr_impl_ref( T & v ): v_( v ) {
+  }
+  inline operator T& () const {return v_;}
+};
+template<class T> struct addressof_impl {
+  static inline T * f( T & v, long )     {
+    return reinterpret_cast<T*>(&const_cast<char&>(reinterpret_cast<const volatile char &>(v)));
+  }
+};
+template<class T> T * addressof( T & v ) {
+  return addressof_impl<T>::f( addr_impl_ref<T>( v ), 0 );
+}
+void testRadar11487525_1(){
+  bool s[25];
+  addressof(s);
+}