diff --git a/clang/lib/Analysis/CFRefCount.cpp b/clang/lib/Analysis/CFRefCount.cpp
index cc73841b78e84105ed2237ca0c7d259c20f1898f..fb253a3c8ffc1b642d053e67b254d672fb013086 100644
--- a/clang/lib/Analysis/CFRefCount.cpp
+++ b/clang/lib/Analysis/CFRefCount.cpp
@@ -2942,6 +2942,16 @@ void CFRefCount::EvalSummary(ExplodedNodeSet& Dst,
 
       QualType T = Ex->getType();
 
+      // For CallExpr, use the result type to know if it returns a reference.
+      if (const CallExpr *CE = dyn_cast<CallExpr>(Ex)) {
+        const Expr *Callee = CE->getCallee();
+        SVal L = state->getSVal(Callee);
+        
+        const FunctionDecl *FD = L.getAsFunctionDecl();
+        if (FD)
+          T = FD->getResultType();
+      }
+
       if (Loc::IsLocType(T) || (T->isIntegerType() && T->isScalarType())) {
         unsigned Count = Builder.getCurrentBlockCount();
         ValueManager &ValMgr = Eng.getValueManager();
diff --git a/clang/test/Analysis/misc-ps-region-store.cpp b/clang/test/Analysis/misc-ps-region-store.cpp
index 838ac39d5c1e9198ab8c197227ac60070485aad7..c3e07b26b0073d779e3a5acc61c1ddf722ab1eb6 100644
--- a/clang/test/Analysis/misc-ps-region-store.cpp
+++ b/clang/test/Analysis/misc-ps-region-store.cpp
@@ -1,6 +1,5 @@
 // RUN: %clang_cc1 -triple i386-apple-darwin9 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -verify -fblocks -analyzer-opt-analyze-nested-blocks %s
 // RUN: %clang_cc1 -triple x86_64-apple-darwin9 -analyze -analyzer-experimental-internal-checks -checker-cfref -analyzer-store=region -verify -fblocks   -analyzer-opt-analyze-nested-blocks %s
-// XFAIL: *
 
 // Test basic handling of references.
 char &test1_aux();
@@ -8,7 +7,7 @@ char *test1() {
   return &test1_aux();
 }
 
-// This test currently crasehs because test1_aux() evaluates to a 'char' instead of a char& in CFRefCount.cpp.
+// Test test1_aux() evaluates to char &.
 char test1_as_rvalue() {
   return test1_aux();
 }