diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h b/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
index bfb255a..1570d95 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
@@ -142,10 +142,12 @@
 protected:
   friend class CallEventManager;
 
-  CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
+  CallEvent(const Expr *E, const ProgramStateRef &state,
+            const LocationContext *lctx)
     : State(state), LCtx(lctx), Origin(E), RefCount(0) {}
 
-  CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
+  CallEvent(const Decl *D, const ProgramStateRef &state,
+            const LocationContext *lctx)
     : State(state), LCtx(lctx), Origin(D), RefCount(0) {}
 
   // DO NOT MAKE PUBLIC
@@ -181,7 +183,7 @@
   }
 
   /// \brief The state in which the call is being evaluated.
-  ProgramStateRef getState() const {
+  const ProgramStateRef &getState() const {
     return State;
   }
 
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h b/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
index 4558cd9..42e50ab 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
@@ -119,7 +119,7 @@
   /// the state of the program before the checker ran. Note, checkers should
   /// not retain the node in their state since the nodes might get invalidated.
   ExplodedNode *getPredecessor() { return Pred; }
-  ProgramStateRef getState() const { return Pred->getState(); }
+  const ProgramStateRef &getState() const { return Pred->getState(); }
 
   /// \brief Check if the checker changed the state of the execution; ex: added
   /// a new transition or a bug report.
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h b/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
index 971a280..35b6564 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
@@ -122,7 +122,7 @@
 
 public:
 
-  explicit ExplodedNode(const ProgramPoint &loc, ProgramStateRef state,
+  explicit ExplodedNode(const ProgramPoint &loc, const ProgramStateRef &state,
                         bool IsSink)
     : Location(loc), State(state), Succs(IsSink) {
     assert(isSink() == IsSink);
@@ -152,7 +152,7 @@
     return *getLocationContext()->getAnalysis<T>();
   }
 
-  ProgramStateRef getState() const { return State; }
+  const ProgramStateRef &getState() const { return State; }
 
   template <typename T>
   const T* getLocationAs() const LLVM_LVALUE_FUNCTION {