diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h b/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
index 1570d95..1000646 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
@@ -142,12 +142,10 @@
 protected:
   friend class CallEventManager;
 
-  CallEvent(const Expr *E, const ProgramStateRef &state,
-            const LocationContext *lctx)
+  CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
     : State(state), LCtx(lctx), Origin(E), RefCount(0) {}
 
-  CallEvent(const Decl *D, const ProgramStateRef &state,
-            const LocationContext *lctx)
+  CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
     : State(state), LCtx(lctx), Origin(D), RefCount(0) {}
 
   // DO NOT MAKE PUBLIC
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h b/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
index 35b6564..519924d 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h
@@ -122,7 +122,7 @@
 
 public:
 
-  explicit ExplodedNode(const ProgramPoint &loc, const ProgramStateRef &state,
+  explicit ExplodedNode(const ProgramPoint &loc, ProgramStateRef state,
                         bool IsSink)
     : Location(loc), State(state), Succs(IsSink) {
     assert(isSink() == IsSink);