Index: lib/StaticAnalyzer/Core/ExprEngine.cpp
===================================================================
--- lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -2386,6 +2386,7 @@
     const auto *DeclRefEx = dyn_cast<DeclRefExpr>(Ex);
     SVal V;
     bool IsReference;
+    QualType Ty;
     if (AMgr.options.shouldInlineLambdas() && DeclRefEx &&
         DeclRefEx->refersToEnclosingVariableOrCapture() && MD &&
         MD->getParent()->isLambda()) {
@@ -2400,14 +2401,14 @@
         // created in the lambda object.
         assert(VD->getType().isConstQualified());
         V = state->getLValue(VD, LocCtxt);
-        IsReference = false;
       } else {
         Loc CXXThis =
             svalBuilder.getCXXThis(MD, LocCtxt->getCurrentStackFrame());
         SVal CXXThisVal = state->getSVal(CXXThis);
         V = state->getLValue(FD, CXXThisVal);
-        IsReference = FD->getType()->isReferenceType();
+        Ty = FD->getType();
       }
+      IsReference = FD && FD->getType()->isReferenceType();
     } else {
       V = state->getLValue(VD, LocCtxt);
       IsReference = VD->getType()->isReferenceType();
@@ -2417,7 +2418,7 @@
     // reference region.
     if (IsReference) {
       if (const MemRegion *R = V.getAsRegion())
-        V = state->getSVal(R);
+        V = state->getSVal(R, Ty);
       else
         V = UnknownVal();
     }