Index: cfe/trunk/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
===================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/DereferenceChecker.cpp
@@ -253,12 +253,6 @@
   if (!TVR->getValueType()->isReferenceType())
     return;
 
-  // FIXME: This is a hotfix for https://llvm.org/bugs/show_bug.cgi?id=31592
-  // A proper fix is very much necessary. Otherwise we would never normally bind
-  // a NonLoc to a reference.
-  if (V.getAs<NonLoc>())
-    return;
-
   ProgramStateRef State = C.getState();
 
   ProgramStateRef StNonNull, StNull;
Index: cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp
===================================================================
--- cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ cfe/trunk/lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -515,8 +515,9 @@
           Init = ASE->getBase()->IgnoreImplicit();
 
         SVal LValue = State->getSVal(Init, stackFrame);
-        if (Optional<Loc> LValueLoc = LValue.getAs<Loc>())
-          InitVal = State->getSVal(*LValueLoc);
+        if (!Field->getType()->isReferenceType())
+          if (Optional<Loc> LValueLoc = LValue.getAs<Loc>())
+            InitVal = State->getSVal(*LValueLoc);
 
         // If we fail to get the value for some reason, use a symbolic value.
         if (InitVal.isUnknownOrUndef()) {