diff --git a/include/clang/StaticAnalyzer/PathSensitive/ObjCMessage.h b/include/clang/StaticAnalyzer/PathSensitive/ObjCMessage.h
index 4e5ce09..1af4e02 100644
--- a/include/clang/StaticAnalyzer/PathSensitive/ObjCMessage.h
+++ b/include/clang/StaticAnalyzer/PathSensitive/ObjCMessage.h
@@ -78,7 +78,10 @@
     assert(isValid() && "This ObjCMessage is uninitialized!");
     if (const ObjCMessageExpr *msgE = dyn_cast<ObjCMessageExpr>(MsgOrPropE))
       return msgE->getInstanceReceiver();
-    return cast<ObjCPropertyRefExpr>(MsgOrPropE)->getBase();
+    const ObjCPropertyRefExpr *propE = cast<ObjCPropertyRefExpr>(MsgOrPropE);
+    if (propE->isObjectReceiver())
+      return propE->getBase();
+    return 0;
   }
 
   bool isInstanceMessage() const {
diff --git a/lib/StaticAnalyzer/Checkers/ExprEngine.cpp b/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
index 8ad094b..79d2a2b 100644
--- a/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
+++ b/lib/StaticAnalyzer/Checkers/ExprEngine.cpp
@@ -2073,12 +2073,13 @@
 void ExprEngine::VisitObjCPropertyRefExpr(const ObjCPropertyRefExpr *Ex,
                                           ExplodedNode *Pred,
                                           ExplodedNodeSet &Dst) {
-
-  // Visit the base expression, which is needed for computing the lvalue
-  // of the ivar.
   ExplodedNodeSet dstBase;
-  const Expr *baseExpr = Ex->getBase();
-  Visit(baseExpr, Pred, dstBase);
+
+  // Visit the receiver (if any).
+  if (Ex->isObjectReceiver())
+    Visit(Ex->getBase(), Pred, dstBase);
+  else
+    dstBase = Pred;
 
   ExplodedNodeSet dstPropRef;
 
@@ -2087,7 +2088,6 @@
        I!=E; ++I) {
     ExplodedNode *nodeBase = *I;
     const GRState *state = GetState(nodeBase);
-    SVal baseVal = state->getSVal(baseExpr);
     MakeNode(dstPropRef, Ex, *I, state->BindExpr(Ex, loc::ObjCPropRef(Ex)));
   }
   
diff --git a/test/Analysis/properties.m b/test/Analysis/properties.m
index b0325a1..ce8faf5 100644
--- a/test/Analysis/properties.m
+++ b/test/Analysis/properties.m
@@ -133,3 +133,13 @@
   p.name = [[NSString string] retain]; // expected-warning {{leak}}
   p.name = [[NSString alloc] init]; // expected-warning {{leak}}
 }
+
+@interface SubPerson : Person
+-(NSString *)foo;
+@end
+
+@implementation SubPerson
+-(NSString *)foo {
+  return super.name;
+}
+@end