Update to 17.0.6

Resolves: RHEL-11161

cfg.patch

@@ -0,0 +1,298 @@
+commit ad4a5130277776d8f15f40ac5a6dede6ad3aabfb
+Author: Timm Bäder <tbaeder@redhat.com>
+Date:   Tue Aug 8 14:11:33 2023 +0200
+
+    [clang][CFG] Cleanup functions
+    
+    Add declarations declared with attribute(cleanup(...)) to the CFG,
+    similar to destructors.
+    
+    Differential Revision: https://reviews.llvm.org/D157385
+
+diff --git a/clang/include/clang/Analysis/CFG.h b/clang/include/clang/Analysis/CFG.h
+index cf4fa2da2a35..67383bb316d3 100644
+--- a/clang/include/clang/Analysis/CFG.h
++++ b/clang/include/clang/Analysis/CFG.h
+@@ -14,10 +14,11 @@
+ #ifndef LLVM_CLANG_ANALYSIS_CFG_H
+ #define LLVM_CLANG_ANALYSIS_CFG_H
+ 
+-#include "clang/Analysis/Support/BumpVector.h"
+-#include "clang/Analysis/ConstructionContext.h"
++#include "clang/AST/Attr.h"
+ #include "clang/AST/ExprCXX.h"
+ #include "clang/AST/ExprObjC.h"
++#include "clang/Analysis/ConstructionContext.h"
++#include "clang/Analysis/Support/BumpVector.h"
+ #include "clang/Basic/LLVM.h"
+ #include "llvm/ADT/DenseMap.h"
+ #include "llvm/ADT/GraphTraits.h"
+@@ -74,7 +75,8 @@ public:
+     MemberDtor,
+     TemporaryDtor,
+     DTOR_BEGIN = AutomaticObjectDtor,
+-    DTOR_END = TemporaryDtor
++    DTOR_END = TemporaryDtor,
++    CleanupFunction,
+   };
+ 
+ protected:
+@@ -383,6 +385,32 @@ private:
+   }
+ };
+ 
++class CFGCleanupFunction final : public CFGElement {
++public:
++  CFGCleanupFunction() = default;
++  CFGCleanupFunction(const VarDecl *VD)
++      : CFGElement(Kind::CleanupFunction, VD) {
++    assert(VD->hasAttr<CleanupAttr>());
++  }
++
++  const VarDecl *getVarDecl() const {
++    return static_cast<VarDecl *>(Data1.getPointer());
++  }
++
++  /// Returns the function to be called when cleaning up the var decl.
++  const FunctionDecl *getFunctionDecl() const {
++    const CleanupAttr *A = getVarDecl()->getAttr<CleanupAttr>();
++    return A->getFunctionDecl();
++  }
++
++private:
++  friend class CFGElement;
++
++  static bool isKind(const CFGElement E) {
++    return E.getKind() == Kind::CleanupFunction;
++  }
++};
++
+ /// Represents C++ object destructor implicitly generated for automatic object
+ /// or temporary bound to const reference at the point of leaving its local
+ /// scope.
+@@ -1142,6 +1170,10 @@ public:
+     Elements.push_back(CFGAutomaticObjDtor(VD, S), C);
+   }
+ 
++  void appendCleanupFunction(const VarDecl *VD, BumpVectorContext &C) {
++    Elements.push_back(CFGCleanupFunction(VD), C);
++  }
++
+   void appendLifetimeEnds(VarDecl *VD, Stmt *S, BumpVectorContext &C) {
+     Elements.push_back(CFGLifetimeEnds(VD, S), C);
+   }
+diff --git a/clang/lib/Analysis/CFG.cpp b/clang/lib/Analysis/CFG.cpp
+index b82f9010a83f..03ab4c6fdf29 100644
+--- a/clang/lib/Analysis/CFG.cpp
++++ b/clang/lib/Analysis/CFG.cpp
+@@ -881,6 +881,10 @@ private:
+     B->appendAutomaticObjDtor(VD, S, cfg->getBumpVectorContext());
+   }
+ 
++  void appendCleanupFunction(CFGBlock *B, VarDecl *VD) {
++    B->appendCleanupFunction(VD, cfg->getBumpVectorContext());
++  }
++
+   void appendLifetimeEnds(CFGBlock *B, VarDecl *VD, Stmt *S) {
+     B->appendLifetimeEnds(VD, S, cfg->getBumpVectorContext());
+   }
+@@ -1346,7 +1350,8 @@ private:
+     return {};
+   }
+ 
+-  bool hasTrivialDestructor(VarDecl *VD);
++  bool hasTrivialDestructor(const VarDecl *VD) const;
++  bool needsAutomaticDestruction(const VarDecl *VD) const;
+ };
+ 
+ } // namespace
+@@ -1861,14 +1866,14 @@ void CFGBuilder::addAutomaticObjDestruction(LocalScope::const_iterator B,
+   if (B == E)
+     return;
+ 
+-  SmallVector<VarDecl *, 10> DeclsNonTrivial;
+-  DeclsNonTrivial.reserve(B.distance(E));
++  SmallVector<VarDecl *, 10> DeclsNeedDestruction;
++  DeclsNeedDestruction.reserve(B.distance(E));
+ 
+   for (VarDecl* D : llvm::make_range(B, E))
+-    if (!hasTrivialDestructor(D))
+-      DeclsNonTrivial.push_back(D);
++    if (needsAutomaticDestruction(D))
++      DeclsNeedDestruction.push_back(D);
+ 
+-  for (VarDecl *VD : llvm::reverse(DeclsNonTrivial)) {
++  for (VarDecl *VD : llvm::reverse(DeclsNeedDestruction)) {
+     if (BuildOpts.AddImplicitDtors) {
+       // If this destructor is marked as a no-return destructor, we need to
+       // create a new block for the destructor which does not have as a
+@@ -1879,7 +1884,8 @@ void CFGBuilder::addAutomaticObjDestruction(LocalScope::const_iterator B,
+         Ty = getReferenceInitTemporaryType(VD->getInit());
+       Ty = Context->getBaseElementType(Ty);
+ 
+-      if (Ty->getAsCXXRecordDecl()->isAnyDestructorNoReturn())
++      const CXXRecordDecl *CRD = Ty->getAsCXXRecordDecl();
++      if (CRD && CRD->isAnyDestructorNoReturn())
+         Block = createNoReturnBlock();
+     }
+ 
+@@ -1890,8 +1896,10 @@ void CFGBuilder::addAutomaticObjDestruction(LocalScope::const_iterator B,
+     // objects, we end lifetime with scope end.
+     if (BuildOpts.AddLifetime)
+       appendLifetimeEnds(Block, VD, S);
+-    if (BuildOpts.AddImplicitDtors)
++    if (BuildOpts.AddImplicitDtors && !hasTrivialDestructor(VD))
+       appendAutomaticObjDtor(Block, VD, S);
++    if (VD->hasAttr<CleanupAttr>())
++      appendCleanupFunction(Block, VD);
+   }
+ }
+ 
+@@ -1922,7 +1930,7 @@ void CFGBuilder::addScopeExitHandling(LocalScope::const_iterator B,
+   // is destroyed, for automatic variables, this happens when the end of the
+   // scope is added.
+   for (VarDecl* D : llvm::make_range(B, E))
+-    if (hasTrivialDestructor(D))
++    if (!needsAutomaticDestruction(D))
+       DeclsTrivial.push_back(D);
+ 
+   if (DeclsTrivial.empty())
+@@ -2095,7 +2103,11 @@ LocalScope* CFGBuilder::addLocalScopeForDeclStmt(DeclStmt *DS,
+   return Scope;
+ }
+ 
+-bool CFGBuilder::hasTrivialDestructor(VarDecl *VD) {
++bool CFGBuilder::needsAutomaticDestruction(const VarDecl *VD) const {
++  return !hasTrivialDestructor(VD) || VD->hasAttr<CleanupAttr>();
++}
++
++bool CFGBuilder::hasTrivialDestructor(const VarDecl *VD) const {
+   // Check for const references bound to temporary. Set type to pointee.
+   QualType QT = VD->getType();
+   if (QT->isReferenceType()) {
+@@ -2149,7 +2161,7 @@ LocalScope* CFGBuilder::addLocalScopeForVarDecl(VarDecl *VD,
+     return Scope;
+ 
+   if (!BuildOpts.AddLifetime && !BuildOpts.AddScopes &&
+-      hasTrivialDestructor(VD)) {
++      !needsAutomaticDestruction(VD)) {
+     assert(BuildOpts.AddImplicitDtors);
+     return Scope;
+   }
+@@ -5287,6 +5299,7 @@ CFGImplicitDtor::getDestructorDecl(ASTContext &astContext) const {
+     case CFGElement::CXXRecordTypedCall:
+     case CFGElement::ScopeBegin:
+     case CFGElement::ScopeEnd:
++    case CFGElement::CleanupFunction:
+       llvm_unreachable("getDestructorDecl should only be used with "
+                        "ImplicitDtors");
+     case CFGElement::AutomaticObjectDtor: {
+@@ -5830,6 +5843,11 @@ static void print_elem(raw_ostream &OS, StmtPrinterHelper &Helper,
+     break;
+   }
+ 
++  case CFGElement::Kind::CleanupFunction:
++    OS << "CleanupFunction ("
++       << E.castAs<CFGCleanupFunction>().getFunctionDecl()->getName() << ")\n";
++    break;
++
+   case CFGElement::Kind::LifetimeEnds:
+     Helper.handleDecl(E.castAs<CFGLifetimeEnds>().getVarDecl(), OS);
+     OS << " (Lifetime ends)\n";
+diff --git a/clang/lib/Analysis/PathDiagnostic.cpp b/clang/lib/Analysis/PathDiagnostic.cpp
+index 348afc42319e..0cb03943c547 100644
+--- a/clang/lib/Analysis/PathDiagnostic.cpp
++++ b/clang/lib/Analysis/PathDiagnostic.cpp
+@@ -567,6 +567,7 @@ getLocationForCaller(const StackFrameContext *SFC,
+   }
+   case CFGElement::ScopeBegin:
+   case CFGElement::ScopeEnd:
++  case CFGElement::CleanupFunction:
+     llvm_unreachable("not yet implemented!");
+   case CFGElement::LifetimeEnds:
+   case CFGElement::LoopExit:
+diff --git a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
+index 0e2ac78f7089..d7c5bd1d4042 100644
+--- a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
++++ b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
+@@ -993,6 +993,7 @@ void ExprEngine::processCFGElement(const CFGElement E, ExplodedNode *Pred,
+       ProcessLoopExit(E.castAs<CFGLoopExit>().getLoopStmt(), Pred);
+       return;
+     case CFGElement::LifetimeEnds:
++    case CFGElement::CleanupFunction:
+     case CFGElement::ScopeBegin:
+     case CFGElement::ScopeEnd:
+       return;
+diff --git a/clang/test/Analysis/scopes-cfg-output.cpp b/clang/test/Analysis/scopes-cfg-output.cpp
+index 6877d124e67a..4eb8967e3735 100644
+--- a/clang/test/Analysis/scopes-cfg-output.cpp
++++ b/clang/test/Analysis/scopes-cfg-output.cpp
+@@ -1419,3 +1419,68 @@ label:
+     }
+   }
+ }
++
++// CHECK:      [B1]
++// CHECK-NEXT:   1: CFGScopeBegin(i)
++// CHECK-NEXT:   2: int i __attribute__((cleanup(cleanup_int)));
++// CHECK-NEXT:   3: CleanupFunction (cleanup_int)
++// CHECK-NEXT:   4: CFGScopeEnd(i)
++void cleanup_int(int *i);
++void test_cleanup_functions() {
++  int i __attribute__((cleanup(cleanup_int)));
++}
++
++// CHECK:      [B1]
++// CHECK-NEXT:    1: 10
++// CHECK-NEXT:    2: i
++// CHECK-NEXT:    3: [B1.2] = [B1.1]
++// CHECK-NEXT:    4: return;
++// CHECK-NEXT:    5: CleanupFunction (cleanup_int)
++// CHECK-NEXT:    6: CFGScopeEnd(i)
++// CHECK-NEXT:    Preds (1): B3
++// CHECK-NEXT:    Succs (1): B0
++// CHECK:      [B2]
++// CHECK-NEXT:    1: return;
++// CHECK-NEXT:    2: CleanupFunction (cleanup_int)
++// CHECK-NEXT:    3: CFGScopeEnd(i)
++// CHECK-NEXT:    Preds (1): B3
++// CHECK-NEXT:    Succs (1): B0
++// CHECK:      [B3]
++// CHECK-NEXT:    1: CFGScopeBegin(i)
++// CHECK-NEXT:    2: int i __attribute__((cleanup(cleanup_int)));
++// CHECK-NEXT:    3: m
++// CHECK-NEXT:    4: [B3.3] (ImplicitCastExpr, LValueToRValue, int)
++// CHECK-NEXT:    5: 1
++// CHECK-NEXT:    6: [B3.4] == [B3.5]
++// CHECK-NEXT:    T: if [B3.6]
++// CHECK-NEXT:    Preds (1): B4
++// CHECK-NEXT:    Succs (2): B2 B1
++void test_cleanup_functions2(int m) {
++  int i __attribute__((cleanup(cleanup_int)));
++
++  if (m == 1) {
++    return;
++  }
++
++  i = 10;
++  return;
++}
++
++// CHECK:       [B1]
++// CHECK-NEXT:    1: CFGScopeBegin(f)
++// CHECK-NEXT:    2:  (CXXConstructExpr, [B1.3], F)
++// CHECK-NEXT:    3: F f __attribute__((cleanup(cleanup_F)));
++// CHECK-NEXT:    4: CleanupFunction (cleanup_F)
++// CHECK-NEXT:    5: [B1.3].~F() (Implicit destructor)
++// CHECK-NEXT:    6: CFGScopeEnd(f)
++// CHECK-NEXT:    Preds (1): B2
++// CHECK-NEXT:    Succs (1): B0
++class F {
++public:
++  ~F();
++};
++void cleanup_F(F *f);
++
++void test() {
++  F f __attribute((cleanup(cleanup_F)));
++}

clang.spec

@@ -16,7 +16,7 @@
 
 %global maj_ver 17
 %global min_ver 0
-%global patch_ver 1
+%global patch_ver 6
 #global rc_ver 4
 
 %if %{with snapshot_build}
@@ -103,6 +103,11 @@ Patch4:     0001-Produce-DWARF4-by-default.patch
 # Workaround a bug in ORC on ppc64le.
 # More info is available here: https://reviews.llvm.org/D159115#4641826
 Patch5:     0001-Workaround-a-bug-in-ORC-on-ppc64le.patch
+# Patches for https://issues.redhat.com/browse/RHEL-1650
+# Remove in clang 18.
+Patch6:     cfg.patch
+Patch7:     tsa.patch
+
 
 # RHEL specific patches
 Patch101:     0009-disable-recommonmark.patch
@@ -747,6 +752,9 @@ mv ./libclang-cpp.so.%{compat_maj_ver} "$compat_lib"
 
 %endif
 %changelog
+* Wed Dec 06 2023 Timm Bäder <tbaeder@redhat.com> - 17.0.6-1
+- Update to 17.0.6
+
 * Wed Oct 04 2023 Timm Bäder <tbaeder@redhat.com> - 17.0.1-2
 - Pick up macros.clang changes from Fedora
 

sources

@@ -1,10 +1,10 @@
-SHA512 (clang-17.0.1.src.tar.xz.sig) = 40ebd4b4b2102f130734388c4368fa21d3c7dd3b88e6ef1bf167416d17dafc60a216ec80d87e13465b7b450349310d1cb44b56b9e6166d3bef41c96230a5cc32
+SHA512 (clang-17.0.6.src.tar.xz) = da6f670a52d60c46bbe6bfa2870106f6a6714c9566fab293b8c624a555308104a1a05cd065643091d7006ef4533a9a722dff1fccaf26f348a0c0a5c7b9331439
-SHA512 (clang-tools-extra-17.0.1.src.tar.xz.sig) = 9a08b574ced425ebe42790257afa42963483292c9866e2fcf114fe0aca1626e771ce97cf52196c070f0d26e695f17684c7da6937925175369e990aaf82aa8843
+SHA512 (clang-tools-extra-17.0.6.src.tar.xz) = 5110dd36ee1c966d22760000f0c28cf070fd00b05445d418d264dbd3b48426a203f934e402d408fab2602dbf39a29d66898cc7c69c1a52b5e0e6e7097f9db877
-SHA512 (clang-tools-extra-17.0.1.src.tar.xz) = e4e1b3b39aba0d225312e6c504851cf98fba888cdcadd45a5f3ac6673b1d43e289e3febbd3e18cb0f44b522a6316651a400bb2c2e48e4c650ffa5dc8b4a46d74
+SHA512 (clang-tools-extra-17.0.6.src.tar.xz.sig) = 17ed3072a402ffa9f723e5ae5257a68ea6f9c874bec50d91c88159d38d8c121d23974ff3983f6f0d3308b5ec07086ba5c2d4cabfe6cbefeb6613fc30b577f966
-SHA512 (clang-17.0.1.src.tar.xz) = fe2a74f67d6f45cb53d25864643e5b8e98a7066c8f8862acdd76a73e3b5478fc7220d5f136558ba9dd4043e661d09a3d293e0ad689eedcd491feba0a201e0c51
+SHA512 (clang-17.0.6.src.tar.xz.sig) = 091dca426d275f5a71836f2230e0f12f212527259cc4a941638104b8fcf42b4a122f9c140d07f8c663d38242d10ca5390de1f89d9d7bc0171b66c77a9aebbb3f
-SHA512 (cmake-16.0.6.src.tar.xz.sig) = d20c5e51315aa476775e6ce886684b9f882ce283fc40aa6c1b8f03964c77a1e745e2e1fb00b3488dddfe1a04378e2bfd090350de28e58088525a5305ecb1bea6
-SHA512 (cmake-16.0.6.src.tar.xz) = 52ecd941d2d85a5b668caa5d0d40480cb6a97b3bf1174e634c2a93e9ef6d03670ca7e96abb0a60cb33ba537b93d5788754dab1f2f45c1f623f788162717d088b
-SHA512 (llvm-16.0.6.src.tar.xz.sig) = 9adda28085f4a2e2a64dab1d8e4ff23c5629bbb0bb6b34afc081e44f6f85ac4f3c6cd0c3488af98c0fad939c33f9d2a8a0cbef67a577cd7fe3013bc2200452b1
-SHA512 (llvm-16.0.6.src.tar.xz) = 8d4cdadc9a1ad249fbf9248c8e56f3bcafab73a473a0b0ca73499ed8825c62e27668aac4f1d03341631e5ad93701621e834e9e196ca32eac3ef805cf1c860083
-SHA512 (clang-16.0.6.src.tar.xz.sig) = a3e68c07d61ce62dfe406464f1afce352f36480966ceaa3171889ac1f02441d9df48e938b3e81d6b73b5957dd6623171323a9915281dc052be0c5c7014e75f24
 SHA512 (clang-16.0.6.src.tar.xz) = 92c65b882e1504f4a9b8a3f6b8a24061505987aaacc8bb835115b4e4d74ac3a8c98343a308567b07c6b42bb99877c300bce3c4a5a25ada77abe65606aa25188d
+SHA512 (clang-16.0.6.src.tar.xz.sig) = a3e68c07d61ce62dfe406464f1afce352f36480966ceaa3171889ac1f02441d9df48e938b3e81d6b73b5957dd6623171323a9915281dc052be0c5c7014e75f24
+SHA512 (llvm-16.0.6.src.tar.xz.sig) = 9adda28085f4a2e2a64dab1d8e4ff23c5629bbb0bb6b34afc081e44f6f85ac4f3c6cd0c3488af98c0fad939c33f9d2a8a0cbef67a577cd7fe3013bc2200452b1
+SHA512 (cmake-16.0.6.src.tar.xz) = 52ecd941d2d85a5b668caa5d0d40480cb6a97b3bf1174e634c2a93e9ef6d03670ca7e96abb0a60cb33ba537b93d5788754dab1f2f45c1f623f788162717d088b
+SHA512 (cmake-16.0.6.src.tar.xz.sig) = d20c5e51315aa476775e6ce886684b9f882ce283fc40aa6c1b8f03964c77a1e745e2e1fb00b3488dddfe1a04378e2bfd090350de28e58088525a5305ecb1bea6
+SHA512 (llvm-16.0.6.src.tar.xz) = 8d4cdadc9a1ad249fbf9248c8e56f3bcafab73a473a0b0ca73499ed8825c62e27668aac4f1d03341631e5ad93701621e834e9e196ca32eac3ef805cf1c860083

tsa.patch

@@ -0,0 +1,124 @@
+commit cf8e189a99f988398a48148b9ea7901948665ab0
+Author: Timm Bäder <tbaeder@redhat.com>
+Date:   Wed Sep 6 12:19:20 2023 +0200
+
+    [clang][TSA] Thread safety cleanup functions
+    
+    Consider cleanup functions in thread safety analysis.
+    
+    Differential Revision: https://reviews.llvm.org/D152504
+
+diff --git a/clang/include/clang/Analysis/Analyses/ThreadSafetyCommon.h b/clang/include/clang/Analysis/Analyses/ThreadSafetyCommon.h
+index 9d28325c1ea6..13e37ac2b56b 100644
+--- a/clang/include/clang/Analysis/Analyses/ThreadSafetyCommon.h
++++ b/clang/include/clang/Analysis/Analyses/ThreadSafetyCommon.h
+@@ -361,7 +361,7 @@ public:
+     unsigned NumArgs = 0;
+ 
+     // Function arguments
+-    const Expr *const *FunArgs = nullptr;
++    llvm::PointerUnion<const Expr *const *, til::SExpr *> FunArgs = nullptr;
+ 
+     // is Self referred to with -> or .?
+     bool SelfArrow = false;
+diff --git a/clang/lib/Analysis/ThreadSafety.cpp b/clang/lib/Analysis/ThreadSafety.cpp
+index 3107d035254d..3e6ceb7d54c4 100644
+--- a/clang/lib/Analysis/ThreadSafety.cpp
++++ b/clang/lib/Analysis/ThreadSafety.cpp
+@@ -1773,7 +1773,8 @@ void BuildLockset::checkPtAccess(const Expr *Exp, AccessKind AK,
+ ///
+ /// \param Exp   The call expression.
+ /// \param D     The callee declaration.
+-/// \param Self  If \p Exp = nullptr, the implicit this argument.
++/// \param Self  If \p Exp = nullptr, the implicit this argument or the argument
++///              of an implicitly called cleanup function.
+ /// \param Loc   If \p Exp = nullptr, the location.
+ void BuildLockset::handleCall(const Expr *Exp, const NamedDecl *D,
+                               til::LiteralPtr *Self, SourceLocation Loc) {
+@@ -2417,6 +2418,15 @@ void ThreadSafetyAnalyzer::runAnalysis(AnalysisDeclContext &AC) {
+                                     AD.getTriggerStmt()->getEndLoc());
+           break;
+         }
++
++        case CFGElement::CleanupFunction: {
++          const CFGCleanupFunction &CF = BI.castAs<CFGCleanupFunction>();
++          LocksetBuilder.handleCall(/*Exp=*/nullptr, CF.getFunctionDecl(),
++                                    SxBuilder.createVariable(CF.getVarDecl()),
++                                    CF.getVarDecl()->getLocation());
++          break;
++        }
++
+         case CFGElement::TemporaryDtor: {
+           auto TD = BI.castAs<CFGTemporaryDtor>();
+ 
+diff --git a/clang/lib/Analysis/ThreadSafetyCommon.cpp b/clang/lib/Analysis/ThreadSafetyCommon.cpp
+index b8286cef396c..63cc66852a9e 100644
+--- a/clang/lib/Analysis/ThreadSafetyCommon.cpp
++++ b/clang/lib/Analysis/ThreadSafetyCommon.cpp
+@@ -110,7 +110,8 @@ static StringRef ClassifyDiagnostic(QualType VDT) {
+ /// \param D       The declaration to which the attribute is attached.
+ /// \param DeclExp An expression involving the Decl to which the attribute
+ ///                is attached.  E.g. the call to a function.
+-/// \param Self    S-expression to substitute for a \ref CXXThisExpr.
++/// \param Self    S-expression to substitute for a \ref CXXThisExpr in a call,
++///                or argument to a cleanup function.
+ CapabilityExpr SExprBuilder::translateAttrExpr(const Expr *AttrExp,
+                                                const NamedDecl *D,
+                                                const Expr *DeclExp,
+@@ -144,7 +145,11 @@ CapabilityExpr SExprBuilder::translateAttrExpr(const Expr *AttrExp,
+ 
+   if (Self) {
+     assert(!Ctx.SelfArg && "Ambiguous self argument");
+-    Ctx.SelfArg = Self;
++    assert(isa<FunctionDecl>(D) && "Self argument requires function");
++    if (isa<CXXMethodDecl>(D))
++      Ctx.SelfArg = Self;
++    else
++      Ctx.FunArgs = Self;
+ 
+     // If the attribute has no arguments, then assume the argument is "this".
+     if (!AttrExp)
+@@ -312,8 +317,14 @@ til::SExpr *SExprBuilder::translateDeclRefExpr(const DeclRefExpr *DRE,
+               ? (cast<FunctionDecl>(D)->getCanonicalDecl() == Canonical)
+               : (cast<ObjCMethodDecl>(D)->getCanonicalDecl() == Canonical)) {
+         // Substitute call arguments for references to function parameters
+-        assert(I < Ctx->NumArgs);
+-        return translate(Ctx->FunArgs[I], Ctx->Prev);
++        if (const Expr *const *FunArgs =
++                Ctx->FunArgs.dyn_cast<const Expr *const *>()) {
++          assert(I < Ctx->NumArgs);
++          return translate(FunArgs[I], Ctx->Prev);
++        }
++
++        assert(I == 0);
++        return Ctx->FunArgs.get<til::SExpr *>();
+       }
+     }
+     // Map the param back to the param of the original function declaration
+diff --git a/clang/test/Sema/warn-thread-safety-analysis.c b/clang/test/Sema/warn-thread-safety-analysis.c
+index 355616b73d96..642ea88ec3c9 100644
+--- a/clang/test/Sema/warn-thread-safety-analysis.c
++++ b/clang/test/Sema/warn-thread-safety-analysis.c
+@@ -72,6 +72,8 @@ int get_value(int *p) SHARED_LOCKS_REQUIRED(foo_.mu_){
+   return *p;
+ }
+ 
++void unlock_scope(struct Mutex *const *mu) __attribute__((release_capability(**mu)));
++
+ int main(void) {
+ 
+   Foo_fun1(1); // expected-warning{{calling function 'Foo_fun1' requires holding mutex 'mu2'}} \
+@@ -127,6 +129,13 @@ int main(void) {
+                                 // expected-note@-1{{mutex released here}}
+   mutex_shared_unlock(&mu1);    // expected-warning {{releasing mutex 'mu1' that was not held}}
+ 
++  /// Cleanup functions
++  {
++    struct Mutex* const __attribute__((cleanup(unlock_scope))) scope = &mu1;
++    mutex_exclusive_lock(scope);  // Note that we have to lock through scope, because no alias analysis!
++    // Cleanup happens automatically -> no warning.
++  }
++
+   return 0;
+ }
+