diff --git a/hphp/runtime/vm/translator/hopt/hhbctranslator.cpp b/hphp/runtime/vm/translator/hopt/hhbctranslator.cpp
index 38b08956c..4841c6346 100644
--- a/hphp/runtime/vm/translator/hopt/hhbctranslator.cpp
+++ b/hphp/runtime/vm/translator/hopt/hhbctranslator.cpp
@@ -2359,6 +2359,9 @@ void HhbcTranslator::emitVerifyParamType(int32_t paramId) {
   // For non-object guards, we rely on what we know from the tracelet
   // guards and never have to do runtime checks.
   if (!tc.isObjectOrTypedef()) {
+    if (locVal->type().isBoxed()) {
+      locVal = gen(LdRef, locVal->type().innerType(), getExitTrace(), locVal);
+    }
     if (!tc.checkPrimitive(locType.toDataType())) {
       exceptionBarrier();
       gen(VerifyParamFail, cns(paramId));
diff --git a/hphp/test/slow/types/ref_type_fail.php b/hphp/test/slow/types/ref_type_fail.php
new file mode 100644
index 000000000..f697047ae
--- /dev/null
+++ b/hphp/test/slow/types/ref_type_fail.php
@@ -0,0 +1,16 @@
+<?php
+
+function handler() { var_dump(__METHOD__); return true; }
+set_error_handler('handler');
+
+function foo(array &$a) { var_dump($a); }
+
+function test($a) {
+  foo($a);
+}
+
+test("hello");
+test(array(1,2,3));
+test(array());
+test("hello");
+
diff --git a/hphp/test/slow/types/ref_type_fail.php.expect b/hphp/test/slow/types/ref_type_fail.php.expect
new file mode 100644
index 000000000..a5c16fb10
--- /dev/null
+++ b/hphp/test/slow/types/ref_type_fail.php.expect
@@ -0,0 +1,14 @@
+string(7) "handler"
+string(5) "hello"
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}
+array(0) {
+}
+string(7) "handler"
+string(5) "hello"