Index: lib/StaticAnalyzer/Core/ExprEngine.cpp
===================================================================
--- lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -1044,6 +1044,10 @@
       return;
     }
     Region = ValueRegion->getBaseRegion();
+    if (!isa<TypedValueRegion>(Region))
+      // Loop widening will sometimes invalidate typed regions.
+      return;
+ 
     varType = cast<TypedValueRegion>(Region)->getValueType();
   }
 
Index: test/Analysis/loop-widening-invalid-type.cpp
===================================================================
--- /dev/null
+++ test/Analysis/loop-widening-invalid-type.cpp
@@ -0,0 +1,11 @@
+// RUN: %clang_cc1 -analyze -analyzer-checker=core,unix.Malloc,debug.ExprInspection -analyzer-max-loop 4 -analyzer-config widen-loops=true -verify %s
+
+struct A {
+  ~A() {}
+};
+struct B : public A {};
+
+void invalid_type_region_access() { // expected-no-diagnostics
+  const A &x = B();
+  for(int i = 0; i < 10; ++i) {}
+}