angr's CFG does not understand the effect of __builtin_return_address()

Here is an example in x86 libc-2.27.so:

Function sub_13738d:

.text:0013738D mov     edi, [esp+0]
.text:00137390

Function sub_46710:

.text:00046710 push    ebp
.text:00046711 mov     ebp, esp
.text:00046713 push    edi
.text:00046714 push    esi
.text:00046715 push    ebx
.text:00046716 lea     esi, [ebp+var_848]
.text:0004671C call    sub_13738D
.text:00046721 add     edi, 1918DFh
.text:00046727 sub     esp, 8ECh
.text:0004672D mov     [ebp+var_890], eax
.text:00046733 mov     eax, [ebp+arg_4]
.text:00046736 mov     [ebp+data_region_ptr], edi

...

.text:00047316 mov     eax, esi
.text:00047318 mov     esi, [ebp+data_region_ptr]
.text:0004731E movsx   eax, al
.text:00047321 movzx   eax, byte ptr [esi+eax-603A0h]
.text:00047329 mov     eax, ds:(jpt_47337 - 1D8000h)[esi+eax*4] ; switch 32 cases
.text:00047330 lea     eax, (loc_47033 - 1D8000h)[esi+eax] ; jumptable 00047337 cases 0-13,27-31
.text:00047337 jmp     eax             ; switch jump

To successfully resolve the jump table at 0x47316, angr must understand that the local variable [ebp+data_region_ptr] is a constant and points to the beginning of the data region. Currently angr does not.