Index: src/GenPoly/Lvalue.cc
===================================================================
--- src/GenPoly/Lvalue.cc	(revision a28bc028a8ac17aa6424a10e57bb2666529c0306)
+++ src/GenPoly/Lvalue.cc	(revision ce8c12fdff03df2cb8b704ff8bcc77c923e2b6e1)
@@ -32,4 +32,5 @@
 #include "Common/UniqueName.h"
 #include "Common/utility.h"
+#include "InitTweak/InitTweak.h"
 
 namespace GenPoly {
@@ -40,6 +41,10 @@
 		class Pass1 : public Mutator {
 		  public:
+			typedef Mutator Parent;
 			Pass1();
 
+			// xxx - should this happen to every expression with reference result type? probably just appexpr and varexpr?
+			virtual Type *mutate( ReferenceType * refType );
+			virtual Expression *mutate( VariableExpr *varExpr );
 			virtual Expression *mutate( ApplicationExpr *appExpr );
 			virtual Statement *mutate( ReturnStmt *appExpr );
@@ -105,4 +110,19 @@
 			} // if
 			return funcDecl;
+		}
+
+		Type * Pass1::mutate( ReferenceType * refType ) {
+			Type * base = refType->get_base();
+			refType->set_base( nullptr );
+			delete refType;
+			return new PointerType( Type::Qualifiers(), base );
+		}
+
+		Expression * Pass1::mutate( VariableExpr *varExpr ) {
+			if ( ReferenceType * refType = dynamic_cast< ReferenceType * >( varExpr->get_result() ) ) {
+				varExpr->set_result( refType->acceptMutator( *this ) );
+				return UntypedExpr::createDeref( varExpr );
+			}
+			return Parent::mutate( varExpr );
 		}
 
@@ -165,4 +185,14 @@
 		}
 
+		bool isDeref( Expression * expr ) {
+			if ( UntypedExpr * untyped = dynamic_cast< UntypedExpr * >( expr ) ) {
+				return InitTweak::getFunctionName( untyped ) == "*?";
+			} else if ( ApplicationExpr * appExpr = dynamic_cast< ApplicationExpr * > ( expr ) ) {
+				return InitTweak::getFunctionName( appExpr ) == "*?";
+			} else {
+				return false;
+			}
+		}
+
 		Expression * GeneralizedLvalue::mutate( AddressExpr * addrExpr ) {
 			addrExpr = safe_dynamic_cast< AddressExpr * >( Parent::mutate( addrExpr ) );
@@ -178,4 +208,11 @@
 				delete addrExpr;
 				return new ConditionalExpr( arg1, new AddressExpr( arg2 ), new AddressExpr( arg3 ) );
+			} else if ( isDeref( addrExpr->get_arg() ) ) {
+				// xxx - this doesn't belong here -- move it somewhere else
+				Expression *& arg = InitTweak::getCallArg( addrExpr->get_arg(), 0 );
+				Expression * inner = arg;
+				arg = nullptr;
+				delete addrExpr;
+				return inner;
 			}
 			return addrExpr;