Index: src/GenPoly/Lvalue.cc
===================================================================
--- src/GenPoly/Lvalue.cc	(revision 2a7b3ca400fe85559a7ebbd5d3b09859d5dfc4da)
+++ src/GenPoly/Lvalue.cc	(revision aca65621fec224ce52fce478fdf5225511cb845b)
@@ -32,4 +32,5 @@
 #include "Common/UniqueName.h"
 #include "Common/utility.h"
+#include "InitTweak/InitTweak.h"
 
 namespace GenPoly {
@@ -38,6 +39,10 @@
 		class Pass1 : public Mutator {
 		  public:
+			typedef Mutator Parent;
 			Pass1();
 
+			// xxx - should this happen to every expression with reference result type? probably just appexpr and varexpr?
+			virtual Type *mutate( ReferenceType * refType );
+			virtual Expression *mutate( VariableExpr *varExpr );
 			virtual Expression *mutate( ApplicationExpr *appExpr );
 			virtual Statement *mutate( ReturnStmt *appExpr );
@@ -103,4 +108,19 @@
 			} // if
 			return funcDecl;
+		}
+
+		Type * Pass1::mutate( ReferenceType * refType ) {
+			Type * base = refType->get_base();
+			refType->set_base( nullptr );
+			delete refType;
+			return new PointerType( Type::Qualifiers(), base );
+		}
+
+		Expression * Pass1::mutate( VariableExpr *varExpr ) {
+			if ( ReferenceType * refType = dynamic_cast< ReferenceType * >( varExpr->get_result() ) ) {
+				varExpr->set_result( refType->acceptMutator( *this ) );
+				return UntypedExpr::createDeref( varExpr );
+			}
+			return Parent::mutate( varExpr );
 		}
 
@@ -163,4 +183,14 @@
 		}
 
+		bool isDeref( Expression * expr ) {
+			if ( UntypedExpr * untyped = dynamic_cast< UntypedExpr * >( expr ) ) {
+				return InitTweak::getFunctionName( untyped ) == "*?";
+			} else if ( ApplicationExpr * appExpr = dynamic_cast< ApplicationExpr * > ( expr ) ) {
+				return InitTweak::getFunctionName( appExpr ) == "*?";
+			} else {
+				return false;
+			}
+		}
+
 		Expression * GeneralizedLvalue::mutate( AddressExpr * addrExpr ) {
 			addrExpr = safe_dynamic_cast< AddressExpr * >( Parent::mutate( addrExpr ) );
@@ -176,4 +206,11 @@
 				delete addrExpr;
 				return new ConditionalExpr( arg1, new AddressExpr( arg2 ), new AddressExpr( arg3 ) );
+			} else if ( isDeref( addrExpr->get_arg() ) ) {
+				// xxx - this doesn't belong here -- move it somewhere else
+				Expression *& arg = InitTweak::getCallArg( addrExpr->get_arg(), 0 );
+				Expression * inner = arg;
+				arg = nullptr;
+				delete addrExpr;
+				return inner;
 			}
 			return addrExpr;