Index: src/InitTweak/FixInit.cc
===================================================================
--- src/InitTweak/FixInit.cc	(revision a0fdbd51112d9506c6a29aefc759d19bbb0828fe)
+++ src/InitTweak/FixInit.cc	(revision fea7ca72a864654b68ee68c30d09b8423c12bc64)
@@ -10,5 +10,5 @@
 // Created On       : Wed Jan 13 16:29:30 2016
 // Last Modified By : Rob Schluntz
-// Last Modified On : Thu Apr 28 12:25:14 2016
+// Last Modified On : Fri Apr 29 12:25:40 2016
 // Update Count     : 30
 //
@@ -231,5 +231,7 @@
 		callExpr->set_env( impCpCtorExpr->get_env()->clone() );
 		for ( Type * result : appExpr->get_results() ) {
-			ObjectDecl * ret = new ObjectDecl( retNamer.newName(), DeclarationNode::NoStorageClass, LinkageSpec::C, 0, result->clone(), 0 );
+			result = result->clone();
+			impCpCtorExpr->get_env()->apply( result );
+			ObjectDecl * ret = new ObjectDecl( retNamer.newName(), DeclarationNode::NoStorageClass, LinkageSpec::C, 0, result, 0 );
 			ret->get_type()->set_isConst( false );
 			impCpCtorExpr->get_returnDecls().push_back( ret );
@@ -285,6 +287,29 @@
 			// add that onto the assignment expression so that later steps have the necessary information
 			assign->add_result( returnDecl->get_type()->clone() );
-			// return new CommaExpr( assign, new VariableExpr( returnDecl ) );
-			return assign;
+
+			Expression * retExpr = new CommaExpr( assign, new VariableExpr( returnDecl ) );
+			if ( callExpr->get_results().front()->get_isLvalue() ) {
+				// lvalue returning functions are funny. Lvalue.cc inserts a *? in front of any
+				// lvalue returning non-intrinsic function. Add an AddressExpr to the call to negate
+				// the derefence and change the type of the return temporary from T to T* to properly
+				// capture the return value. Then dereference the result of the comma expression, since
+				// the lvalue returning call was originally wrapped with an AddressExpr.
+				// Effectively, this turns
+				//   lvalue T f();
+				//   &*f()
+				// into
+				//   T * tmp_cp_retN;
+				//   tmp_cp_ret_N = &*(tmp_cp_ret_N = &*f(), tmp_cp_ret);
+				// which work out in terms of types, but is pretty messy. It would be nice to find a better way.
+				assign->get_args().back() = new AddressExpr( assign->get_args().back() );
+
+				Type * resultType = returnDecl->get_type()->clone();
+				returnDecl->set_type( new PointerType( Type::Qualifiers(), returnDecl->get_type() ) );
+				UntypedExpr * deref = new UntypedExpr( new NameExpr( "*?" ) );
+				deref->get_args().push_back( retExpr );
+				deref->add_result( resultType );
+				retExpr = deref;
+			}
+			return retExpr;
 		} else {
 			return callExpr;