Index: lib/Analysis/BodyFarm.cpp
===================================================================
--- lib/Analysis/BodyFarm.cpp
+++ lib/Analysis/BodyFarm.cpp
@@ -412,10 +412,15 @@
 
     CallbackCall = create_call_once_lambda_call(C, M, Callback,
                                                 CallbackRecordDecl, CallArgs);
-  } else {
+  } else if (Callback->getType()->isRValueReferenceType()
+      || Callback->getType()->isLValueReferenceType()) {
 
     // Function pointer case.
     CallbackCall = create_call_once_funcptr_call(C, M, Callback, CallArgs);
+  } else {
+    DEBUG(llvm::dbgs() << "Not a lambda expression, and not a function pointer"
+                       << ", ignoring the std::call_once call.\n");
+    return nullptr;
   }
 
   DeclRefExpr *FlagDecl =
Index: test/Analysis/call_once.cpp
===================================================================
--- test/Analysis/call_once.cpp
+++ test/Analysis/call_once.cpp
@@ -1,6 +1,10 @@
 // RUN: %clang_analyze_cc1 -std=c++11 -fblocks -analyzer-checker=core,debug.ExprInspection -verify %s
 // RUN: %clang_analyze_cc1 -std=c++11 -fblocks -analyzer-checker=core,debug.ExprInspection -DEMULATE_LIBSTDCPP -verify %s
 
+// We do not emulate libcxx03 implementation, but we should not crash either.
+// RUN: %clang_analyze_cc1 -std=c++11 -fblocks -analyzer-checker=core -DEMULATE_LIBCXX03 %s
+// RUN: %clang_analyze_cc1 -std=c++11 -fblocks -analyzer-checker=core -DEMULATE_LIBCXX03 -DEMULATE_LIBSTDCPP %s
+
 void clang_analyzer_eval(bool);
 
 // Faking std::std::call_once implementation.
@@ -16,8 +20,13 @@
 } once_flag;
 #endif
 
+#ifndef EMULATE_LIBCXX03
 template <class Callable, class... Args>
 void call_once(once_flag &o, Callable&& func, Args&&... args) {};
+#else
+template <class Callable, class... Args> // libcxx03 call_once
+void call_once(once_flag &o, Callable func, Args...) {};
+#endif
 
 } // namespace std