diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp
index 2e3e9f51e7df..670786000935 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp
@@ -279,7 +279,6 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
       case CK_Dependent:
       case CK_ArrayToPointerDecay:
       case CK_BitCast:
-      case CK_LValueBitCast:
       case CK_IntegralCast:
       case CK_NullToPointer:
       case CK_IntegralToPointer:
@@ -378,7 +377,8 @@ void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
       case CK_UserDefinedConversion:
       case CK_ConstructorConversion:
       case CK_VectorSplat:
-      case CK_MemberPointerToBoolean: {
+      case CK_MemberPointerToBoolean:
+      case CK_LValueBitCast: {
         // Recover some path-sensitivty by conjuring a new value.
         QualType resultType = CastE->getType();
         if (CastE->isGLValue())
diff --git a/clang/test/Analysis/cxx11-crashes.cpp b/clang/test/Analysis/cxx11-crashes.cpp
index 8c68734da458..16bfc891000f 100644
--- a/clang/test/Analysis/cxx11-crashes.cpp
+++ b/clang/test/Analysis/cxx11-crashes.cpp
@@ -57,3 +57,10 @@ void testRadar11487525_1(){
   bool s[25];
   addressof(s);
 }
+
+// radar://11487525 Don't crash on CK_LValueBitCast.
+bool begin(double *it) {
+  typedef bool type[25];
+  bool *a = reinterpret_cast<type &>(*( reinterpret_cast<char *>( it )));
+  return *a;
+}