diff --git a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
index 3969ee0..0fd81b4 100644
--- a/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -86,7 +86,7 @@
   void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
   void checkEndPath(CheckerContext &C) const;
   void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
-  const ProgramState *evalAssume(const ProgramState *state, SVal Cond,
+  ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
                             bool Assumption) const;
   void checkLocation(SVal l, bool isLoad, const Stmt *S,
                      CheckerContext &C) const;
@@ -97,22 +97,22 @@
   static void MallocMem(CheckerContext &C, const CallExpr *CE);
   static void MallocMemReturnsAttr(CheckerContext &C, const CallExpr *CE,
                                    const OwnershipAttr* Att);
-  static const ProgramState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
+  static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE,
                                      const Expr *SizeEx, SVal Init,
-                                     const ProgramState *state) {
+                                     ProgramStateRef state) {
     return MallocMemAux(C, CE,
                         state->getSVal(SizeEx, C.getLocationContext()),
                         Init, state);
   }
-  static const ProgramState *MallocMemAux(CheckerContext &C, const CallExpr *CE,
+  static ProgramStateRef MallocMemAux(CheckerContext &C, const CallExpr *CE,
                                      SVal SizeEx, SVal Init,
-                                     const ProgramState *state);
+                                     ProgramStateRef state);
 
   void FreeMem(CheckerContext &C, const CallExpr *CE) const;
   void FreeMemAttr(CheckerContext &C, const CallExpr *CE,
                    const OwnershipAttr* Att) const;
-  const ProgramState *FreeMemAux(CheckerContext &C, const CallExpr *CE,
-                                 const ProgramState *state, unsigned Num,
+  ProgramStateRef FreeMemAux(CheckerContext &C, const CallExpr *CE,
+                                 ProgramStateRef state, unsigned Num,
                                  bool Hold) const;
 
   void ReallocMem(CheckerContext &C, const CallExpr *CE) const;
@@ -198,7 +198,7 @@
 }
 
 void MallocChecker::MallocMem(CheckerContext &C, const CallExpr *CE) {
-  const ProgramState *state = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(),
+  ProgramStateRef state = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(),
                                       C.getState());
   C.addTransition(state);
 }
@@ -210,20 +210,20 @@
 
   OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
   if (I != E) {
-    const ProgramState *state =
+    ProgramStateRef state =
         MallocMemAux(C, CE, CE->getArg(*I), UndefinedVal(), C.getState());
     C.addTransition(state);
     return;
   }
-  const ProgramState *state = MallocMemAux(C, CE, UnknownVal(), UndefinedVal(),
+  ProgramStateRef state = MallocMemAux(C, CE, UnknownVal(), UndefinedVal(),
                                         C.getState());
   C.addTransition(state);
 }
 
-const ProgramState *MallocChecker::MallocMemAux(CheckerContext &C,  
+ProgramStateRef MallocChecker::MallocMemAux(CheckerContext &C,  
                                            const CallExpr *CE,
                                            SVal Size, SVal Init,
-                                           const ProgramState *state) {
+                                           ProgramStateRef state) {
   unsigned Count = C.getCurrentBlockCount();
   SValBuilder &svalBuilder = C.getSValBuilder();
 
@@ -253,7 +253,7 @@
 }
 
 void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) const {
-  const ProgramState *state = FreeMemAux(C, CE, C.getState(), 0, false);
+  ProgramStateRef state = FreeMemAux(C, CE, C.getState(), 0, false);
 
   if (state)
     C.addTransition(state);
@@ -266,7 +266,7 @@
 
   for (OwnershipAttr::args_iterator I = Att->args_begin(), E = Att->args_end();
        I != E; ++I) {
-    const ProgramState *state =
+    ProgramStateRef state =
       FreeMemAux(C, CE, C.getState(), *I,
                  Att->getOwnKind() == OwnershipAttr::Holds);
     if (state)
@@ -274,9 +274,9 @@
   }
 }
 
-const ProgramState *MallocChecker::FreeMemAux(CheckerContext &C,
+ProgramStateRef MallocChecker::FreeMemAux(CheckerContext &C,
                                               const CallExpr *CE,
-                                              const ProgramState *state,
+                                              ProgramStateRef state,
                                               unsigned Num,
                                               bool Hold) const {
   const Expr *ArgExpr = CE->getArg(Num);
@@ -290,7 +290,7 @@
 
   // FIXME: Technically using 'Assume' here can result in a path
   //  bifurcation.  In such cases we need to return two states, not just one.
-  const ProgramState *notNullState, *nullState;
+  ProgramStateRef notNullState, nullState;
   llvm::tie(notNullState, nullState) = state->assume(location);
 
   // The explicit NULL case, no operation is performed.
@@ -499,7 +499,7 @@
 }
 
 void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) const {
-  const ProgramState *state = C.getState();
+  ProgramStateRef state = C.getState();
   const Expr *arg0Expr = CE->getArg(0);
   const LocationContext *LCtx = C.getLocationContext();
   DefinedOrUnknownSVal arg0Val 
@@ -526,7 +526,7 @@
 
   // If the ptr is NULL and the size is not 0, the call is equivalent to 
   // malloc(size).
-  const ProgramState *stateEqual = state->assume(PtrEQ, true);
+  ProgramStateRef stateEqual = state->assume(PtrEQ, true);
   if (stateEqual && state->assume(SizeZero, false)) {
     // Hack: set the NULL symbolic region to released to suppress false warning.
     // In the future we should add more states for allocated regions, e.g., 
@@ -536,28 +536,28 @@
     if (Sym)
       stateEqual = stateEqual->set<RegionState>(Sym, RefState::getReleased(CE));
 
-    const ProgramState *stateMalloc = MallocMemAux(C, CE, CE->getArg(1), 
+    ProgramStateRef stateMalloc = MallocMemAux(C, CE, CE->getArg(1), 
                                               UndefinedVal(), stateEqual);
     C.addTransition(stateMalloc);
   }
 
-  if (const ProgramState *stateNotEqual = state->assume(PtrEQ, false)) {
+  if (ProgramStateRef stateNotEqual = state->assume(PtrEQ, false)) {
     // If the size is 0, free the memory.
-    if (const ProgramState *stateSizeZero =
+    if (ProgramStateRef stateSizeZero =
           stateNotEqual->assume(SizeZero, true))
-      if (const ProgramState *stateFree = 
+      if (ProgramStateRef stateFree = 
           FreeMemAux(C, CE, stateSizeZero, 0, false)) {
 
         // Bind the return value to NULL because it is now free.
         C.addTransition(stateFree->BindExpr(CE, LCtx,
                                             svalBuilder.makeNull(), true));
       }
-    if (const ProgramState *stateSizeNotZero =
+    if (ProgramStateRef stateSizeNotZero =
           stateNotEqual->assume(SizeZero,false))
-      if (const ProgramState *stateFree = FreeMemAux(C, CE, stateSizeNotZero,
+      if (ProgramStateRef stateFree = FreeMemAux(C, CE, stateSizeNotZero,
                                                 0, false)) {
         // FIXME: We should copy the content of the original buffer.
-        const ProgramState *stateRealloc = MallocMemAux(C, CE, CE->getArg(1), 
+        ProgramStateRef stateRealloc = MallocMemAux(C, CE, CE->getArg(1), 
                                                    UnknownVal(), stateFree);
         C.addTransition(stateRealloc);
       }
@@ -565,7 +565,7 @@
 }
 
 void MallocChecker::CallocMem(CheckerContext &C, const CallExpr *CE) {
-  const ProgramState *state = C.getState();
+  ProgramStateRef state = C.getState();
   SValBuilder &svalBuilder = C.getSValBuilder();
   const LocationContext *LCtx = C.getLocationContext();
   SVal count = state->getSVal(CE->getArg(0), LCtx);
@@ -583,7 +583,7 @@
   if (!SymReaper.hasDeadSymbols())
     return;
 
-  const ProgramState *state = C.getState();
+  ProgramStateRef state = C.getState();
   RegionStateTy RS = state->get<RegionState>();
   RegionStateTy::Factory &F = state->get_context<RegionState>();
 
@@ -615,7 +615,7 @@
 }
 
 void MallocChecker::checkEndPath(CheckerContext &Ctx) const {
-  const ProgramState *state = Ctx.getState();
+  ProgramStateRef state = Ctx.getState();
   RegionStateTy M = state->get<RegionState>();
 
   for (RegionStateTy::iterator I = M.begin(), E = M.end(); I != E; ++I) {
@@ -638,7 +638,7 @@
   if (!retExpr)
     return;
 
-  const ProgramState *state = C.getState();
+  ProgramStateRef state = C.getState();
 
   SymbolRef Sym = state->getSVal(retExpr, C.getLocationContext()).getAsSymbol();
   if (!Sym)
@@ -655,7 +655,7 @@
   C.addTransition(state);
 }
 
-const ProgramState *MallocChecker::evalAssume(const ProgramState *state,
+ProgramStateRef MallocChecker::evalAssume(ProgramStateRef state,
                                               SVal Cond, 
                                               bool Assumption) const {
   // If a symblic region is assumed to NULL, set its state to AllocateFailed.
@@ -699,7 +699,7 @@
   // assignment, let it go.  However, assigning to fields of a stack-storage 
   // structure does not transfer ownership.
 
-  const ProgramState *state = C.getState();
+  ProgramStateRef state = C.getState();
   DefinedOrUnknownSVal l = cast<DefinedOrUnknownSVal>(location);
 
   // Check for null dereferences.
@@ -712,7 +712,7 @@
   if (Sym) {
     if (const RefState *RS = state->get<RegionState>(Sym)) {
       // If ptr is NULL, no operation is performed.
-      const ProgramState *notNullState, *nullState;
+      ProgramStateRef notNullState, nullState;
       llvm::tie(notNullState, nullState) = state->assume(l);
 
       // Generate a transition for 'nullState' to record the assumption