diff --git a/nullability/pointer_nullability_analysis.cc b/nullability/pointer_nullability_analysis.cc
index 12e9ce7..3791a87 100644
--- a/nullability/pointer_nullability_analysis.cc
+++ b/nullability/pointer_nullability_analysis.cc
@@ -527,9 +527,11 @@
   if (dataflow::RecordStorageLocation *RecordLoc =
           dataflow::getImplicitObjectLocation(*MCE, State.Env)) {
     StorageLocation *Loc = RecordLoc->getChild(*member);
-    PointerVal = dyn_cast<PointerValue>(State.Env.getValue(*Loc));
-  } else {
-    // Use value that may have been set by the builtin transfer function.
+    PointerVal = dyn_cast_or_null<PointerValue>(State.Env.getValue(*Loc));
+  }
+  if (!PointerVal) {
+    // Use value that may have been set by the builtin transfer function or by
+    // `ensurePointerHasValue()`.
     PointerVal = getPointerValueFromExpr(MCE, State.Env);
   }
   if (PointerVal) {
diff --git a/nullability/test/function_calls.cc b/nullability/test/function_calls.cc
index d4f4aa5..51a5c3b 100644
--- a/nullability/test/function_calls.cc
+++ b/nullability/test/function_calls.cc
@@ -692,6 +692,23 @@
   )cc"));
 }
 
+TEST(PointerNullabilityTest, Accessor_BaseObjectReturnedByReference) {
+  // Crash repro:
+  // If the base object of the accessor call expression is a reference returned
+  // from a function call, we have a storage location for the object but no
+  // values for its fields. Check that we don't crash in this case.
+  EXPECT_TRUE(checkDiagnostics(R"cc(
+    struct C {
+      int *_Nullable property() const { return x; }
+      int *_Nullable x = nullptr;
+    };
+    C &foo();
+    void target() {
+      if (foo().property() != nullptr) int x = *foo().property();  // [[unsafe]]
+    }
+  )cc"));
+}
+
 TEST(PointerNullabilityTest, MethodNoParamsUndefinedValue) {
   EXPECT_TRUE(checkDiagnostics(R"cc(
     struct C {