diff --git a/lib/Checker/GRExprEngine.cpp b/lib/Checker/GRExprEngine.cpp
index 964f7fa..ad229c7 100644
--- a/lib/Checker/GRExprEngine.cpp
+++ b/lib/Checker/GRExprEngine.cpp
@@ -2358,8 +2358,9 @@
 
       // Recover some path-sensitivity if a scalar value evaluated to
       // UnknownVal.
-      if (InitVal.isUnknown() ||
-          !getConstraintManager().canReasonAbout(InitVal)) {
+      if ((InitVal.isUnknown() ||
+          !getConstraintManager().canReasonAbout(InitVal)) &&
+          !VD->getType()->isReferenceType()) {
         InitVal = ValMgr.getConjuredSymbolVal(NULL, InitEx,
                                                Builder->getCurrentBlockCount());
       }
@@ -2901,9 +2902,8 @@
   if (Expr *RetE = RS->getRetValue()) {
     // Record the returned expression in the state.
     {
-      static int Tag;
-      SaveAndRestore<const void *> OldTag(Builder->Tag);
-      Builder->Tag = &Tag;
+      static int Tag = 0;
+      SaveAndRestore<const void *> OldTag(Builder->Tag, &Tag);
       const GRState *state = GetState(Pred);
       state = state->set<ReturnExpr>(RetE);
       Pred = Builder->generateNode(RetE, state, Pred);