diff --git a/Driver/RewriteObjC.cpp b/Driver/RewriteObjC.cpp
index 1873146..0674f8f 100644
--- a/Driver/RewriteObjC.cpp
+++ b/Driver/RewriteObjC.cpp
@@ -1778,7 +1778,8 @@
   
   const FunctionType *FT = msgSendType->getAsFunctionType();
   
-  return new (Context) CallExpr(ICE, args, nargs, FT->getResultType(), SourceLocation());
+  return new (Context) CallExpr(*Context, ICE, args, nargs, FT->getResultType(),
+                                SourceLocation());
 }
 
 static bool scanForProtocolRefs(const char *startBuf, const char *endBuf,
@@ -2311,8 +2312,9 @@
         // Simulate a contructor call...
         DeclRefExpr *DRE = new (Context) DeclRefExpr(SuperContructorFunctionDecl, 
                                            superType, SourceLocation());
-        SuperRep = new (Context) CallExpr(DRE, &InitExprs[0], InitExprs.size(), 
-                                superType, SourceLocation());
+        SuperRep = new (Context) CallExpr(*Context, DRE, &InitExprs[0],
+                                          InitExprs.size(), 
+                                          superType, SourceLocation());
         // The code for super is a little tricky to prevent collision with
         // the structure definition in the header. The rewriter has it's own
         // internal definition (__rw_objc_super) that is uses. This is why
@@ -2394,8 +2396,9 @@
         // Simulate a contructor call...
         DeclRefExpr *DRE = new (Context) DeclRefExpr(SuperContructorFunctionDecl, 
                                            superType, SourceLocation());
-        SuperRep = new (Context) CallExpr(DRE, &InitExprs[0], InitExprs.size(), 
-                                superType, SourceLocation());
+        SuperRep = new (Context) CallExpr(*Context, DRE, &InitExprs[0],
+                                          InitExprs.size(), 
+                                          superType, SourceLocation());
         // The code for super is a little tricky to prevent collision with
         // the structure definition in the header. The rewriter has it's own
         // internal definition (__rw_objc_super) that is uses. This is why
@@ -2521,8 +2524,9 @@
   ParenExpr *PE = new (Context) ParenExpr(SourceLocation(), SourceLocation(), cast);
   
   const FunctionType *FT = msgSendType->getAsFunctionType();
-  CallExpr *CE = new (Context) CallExpr(PE, &MsgExprs[0], MsgExprs.size(), 
-                              FT->getResultType(), SourceLocation());
+  CallExpr *CE = new (Context) CallExpr(*Context, PE, &MsgExprs[0],
+                                        MsgExprs.size(), 
+                                        FT->getResultType(), SourceLocation());
   Stmt *ReplacingStmt = CE;
   if (MsgSendStretFlavor) {
     // We have the method which returns a struct/union. Must also generate
@@ -2548,8 +2552,9 @@
     PE = new (Context) ParenExpr(SourceLocation(), SourceLocation(), cast);
     
     FT = msgSendType->getAsFunctionType();
-    CallExpr *STCE = new (Context) CallExpr(PE, &MsgExprs[0], MsgExprs.size(), 
-                                  FT->getResultType(), SourceLocation());
+    CallExpr *STCE = new (Context) CallExpr(*Context, PE, &MsgExprs[0],
+                                            MsgExprs.size(), 
+                                            FT->getResultType(), SourceLocation());
     
     // Build sizeof(returnType)
     SizeOfAlignOfExpr *sizeofExpr = new (Context) SizeOfAlignOfExpr(true, true,
@@ -3864,7 +3869,8 @@
        E = Exp->arg_end(); I != E; ++I) {
     BlkExprs.push_back(*I);
   }
-  CallExpr *CE = new (Context) CallExpr(PE, &BlkExprs[0], BlkExprs.size(),
+  CallExpr *CE = new (Context) CallExpr(*Context, PE, &BlkExprs[0],
+                                        BlkExprs.size(),
                                         Exp->getType(), SourceLocation());
   return CE;
 }
@@ -4157,8 +4163,8 @@
       InitExprs.push_back(Exp); 
     }
   }
-  NewRep = new (Context) CallExpr(DRE, &InitExprs[0], InitExprs.size(),
-                        FType, SourceLocation());
+  NewRep = new (Context) CallExpr(*Context, DRE, &InitExprs[0], InitExprs.size(),
+                                  FType, SourceLocation());
   NewRep = new (Context) UnaryOperator(NewRep, UnaryOperator::AddrOf,
                              Context->getPointerType(NewRep->getType()), 
                              SourceLocation());
diff --git a/include/clang/AST/Expr.h b/include/clang/AST/Expr.h
index 55b31b4..408c660 100644
--- a/include/clang/AST/Expr.h
+++ b/include/clang/AST/Expr.h
@@ -770,13 +770,16 @@
 
 protected:
   // This version of the constructor is for derived classes.
-  CallExpr(StmtClass SC, Expr *fn, Expr **args, unsigned numargs, QualType t, 
-           SourceLocation rparenloc);
+  CallExpr(ASTContext& C, StmtClass SC, Expr *fn, Expr **args, unsigned numargs,
+           QualType t, SourceLocation rparenloc);
   
 public:
-  CallExpr(Expr *fn, Expr **args, unsigned numargs, QualType t, 
+  CallExpr(ASTContext& C, Expr *fn, Expr **args, unsigned numargs, QualType t, 
            SourceLocation rparenloc);
-  ~CallExpr() { delete [] SubExprs; }
+  
+  ~CallExpr() {}
+  
+  void Destroy(ASTContext& C);
   
   const Expr *getCallee() const { return cast<Expr>(SubExprs[FN]); }
   Expr *getCallee() { return cast<Expr>(SubExprs[FN]); }
@@ -795,12 +798,19 @@
     assert(Arg < NumArgs && "Arg access out of range!");
     return cast<Expr>(SubExprs[Arg+ARGS_START]);
   }
+  
+  // FIXME: Why is this needed?  Why not just create the CallExpr with the
+  // corect number of arguments?  It makes the ASTs less brittle.
   /// setArg - Set the specified argument.
   void setArg(unsigned Arg, Expr *ArgExpr) {
     assert(Arg < NumArgs && "Arg access out of range!");
     SubExprs[Arg+ARGS_START] = ArgExpr;
   }
   
+  // FIXME: It would be great to just get rid of this.  There is only one
+  // callee of this method, and it probably could be refactored to not use
+  // this method and instead just create a CallExpr with the right number of
+  // arguments.
   /// setNumArgs - This changes the number of arguments present in this call.
   /// Any orphaned expressions are deleted by this, and any new operands are set
   /// to null.
diff --git a/include/clang/AST/ExprCXX.h b/include/clang/AST/ExprCXX.h
index 26f3b6c..22e852d 100644
--- a/include/clang/AST/ExprCXX.h
+++ b/include/clang/AST/ExprCXX.h
@@ -32,9 +32,9 @@
 /// better information about the syntactic representation of the call.
 class CXXOperatorCallExpr : public CallExpr {
 public:
-  CXXOperatorCallExpr(Expr *fn, Expr **args, unsigned numargs, QualType t,
-                      SourceLocation operatorloc)
-    : CallExpr(CXXOperatorCallExprClass, fn, args, numargs, t, operatorloc) { }
+  CXXOperatorCallExpr(ASTContext& C, Expr *fn, Expr **args, unsigned numargs,
+                      QualType t, SourceLocation operatorloc)
+    : CallExpr(C, CXXOperatorCallExprClass, fn, args, numargs, t, operatorloc){}
 
   /// getOperator - Returns the kind of overloaded operator that this
   /// expression refers to.
@@ -65,9 +65,9 @@
 /// the object argument).
 class CXXMemberCallExpr : public CallExpr {
 public:
-  CXXMemberCallExpr(Expr *fn, Expr **args, unsigned numargs, QualType t,
-                      SourceLocation rparenloc)
-    : CallExpr(CXXMemberCallExprClass, fn, args, numargs, t, rparenloc) { }
+  CXXMemberCallExpr(ASTContext& C, Expr *fn, Expr **args, unsigned numargs,
+                    QualType t, SourceLocation rparenloc)
+    : CallExpr(C, CXXMemberCallExprClass, fn, args, numargs, t, rparenloc) {}
 
   /// getImplicitObjectArgument - Retrieves the implicit object
   /// argument for the member call. For example, in "x.f(5)", this
diff --git a/lib/AST/Expr.cpp b/lib/AST/Expr.cpp
index 27ae2b2..95a6a34 100644
--- a/lib/AST/Expr.cpp
+++ b/lib/AST/Expr.cpp
@@ -105,32 +105,43 @@
 // Postfix Operators.
 //===----------------------------------------------------------------------===//
 
-CallExpr::CallExpr(StmtClass SC, Expr *fn, Expr **args,
+CallExpr::CallExpr(ASTContext& C, StmtClass SC, Expr *fn, Expr **args,
                    unsigned numargs, QualType t, SourceLocation rparenloc)
   : Expr(SC, t, 
          fn->isTypeDependent() || hasAnyTypeDependentArguments(args, numargs),
          fn->isValueDependent() || hasAnyValueDependentArguments(args, numargs)),
     NumArgs(numargs) {
-  SubExprs = new Stmt*[numargs+1];
+      
+  SubExprs = new (C) Stmt*[numargs+1];
   SubExprs[FN] = fn;
   for (unsigned i = 0; i != numargs; ++i)
     SubExprs[i+ARGS_START] = args[i];
+
   RParenLoc = rparenloc;
 }
 
-CallExpr::CallExpr(Expr *fn, Expr **args, unsigned numargs, QualType t,
-                   SourceLocation rparenloc)
+CallExpr::CallExpr(ASTContext& C, Expr *fn, Expr **args, unsigned numargs,
+                   QualType t, SourceLocation rparenloc)
   : Expr(CallExprClass, t,
          fn->isTypeDependent() || hasAnyTypeDependentArguments(args, numargs),
          fn->isValueDependent() || hasAnyValueDependentArguments(args, numargs)),
     NumArgs(numargs) {
-  SubExprs = new Stmt*[numargs+1];
+
+  SubExprs = new (C) Stmt*[numargs+1];
   SubExprs[FN] = fn;
   for (unsigned i = 0; i != numargs; ++i)
     SubExprs[i+ARGS_START] = args[i];
+
   RParenLoc = rparenloc;
 }
 
+void CallExpr::Destroy(ASTContext& C) {
+  DestroyChildren(C);
+  if (SubExprs) C.Deallocate(SubExprs);
+  this->~CallExpr();
+  C.Deallocate(this);
+}
+
 /// setNumArgs - This changes the number of arguments present in this call.
 /// Any orphaned expressions are deleted by this, and any new operands are set
 /// to null.
diff --git a/lib/AST/StmtSerialization.cpp b/lib/AST/StmtSerialization.cpp
index 4d92245..5a6e49c 100644
--- a/lib/AST/StmtSerialization.cpp
+++ b/lib/AST/StmtSerialization.cpp
@@ -402,7 +402,6 @@
   unsigned NumArgs = D.ReadInt();
   Stmt** SubExprs = new (C, llvm::alignof<Stmt*>()) Stmt*[NumArgs+1];
   D.BatchReadOwnedPtrs(NumArgs+1, SubExprs, C);
-
   return new (C, llvm::alignof<CallExpr>()) CallExpr(SC, SubExprs,NumArgs,t,L);  
 }
 
diff --git a/lib/Sema/SemaExpr.cpp b/lib/Sema/SemaExpr.cpp
index f881e81..af41796 100644
--- a/lib/Sema/SemaExpr.cpp
+++ b/lib/Sema/SemaExpr.cpp
@@ -1226,8 +1226,8 @@
         UsualUnaryConversions(FnExpr);
 
         Input.release();
-        return Owned(new (Context)CXXOperatorCallExpr(FnExpr, Args, 2, ResultTy, 
-                                                   OpLoc));
+        return Owned(new (Context) CXXOperatorCallExpr(Context, FnExpr, Args, 2,
+                                                       ResultTy, OpLoc));
       } else {
         // We matched a built-in operator. Convert the arguments, then
         // break out so that we will build the appropriate built-in
@@ -1326,7 +1326,7 @@
 
         Base.release();
         Idx.release();
-        return Owned(new (Context) CXXOperatorCallExpr(FnExpr, Args, 2, 
+        return Owned(new (Context) CXXOperatorCallExpr(Context, FnExpr, Args, 2, 
                                                        ResultTy, LLoc));
       } else {
         // We matched a built-in operator. Convert the arguments, then
@@ -1850,7 +1850,7 @@
       Dependent = true;
 
     if (Dependent)
-      return Owned(new (Context) CallExpr(Fn, Args, NumArgs,
+      return Owned(new (Context) CallExpr(Context, Fn, Args, NumArgs,
                                           Context.DependentTy, RParenLoc));
 
     // Determine whether this is a call to an object (C++ [over.call.object]).
@@ -1943,8 +1943,10 @@
   // of arguments and function on error.
   // FIXME: Except that llvm::OwningPtr uses delete, when it really must be
   // Destroy(), or nothing gets cleaned up.
-  ExprOwningPtr<CallExpr> TheCall(this, new (Context) CallExpr(Fn, Args,NumArgs,
-                                                 Context.BoolTy, RParenLoc));
+  ExprOwningPtr<CallExpr> TheCall(this, new (Context) CallExpr(Context, Fn,
+                                                               Args, NumArgs,
+                                                               Context.BoolTy,
+                                                               RParenLoc));
 
   const FunctionType *FuncT;
   if (!Fn->getType()->isBlockPointerType()) {
@@ -3795,7 +3797,7 @@
                                                  SourceLocation());
         UsualUnaryConversions(FnExpr);
 
-        return Owned(new (Context) CXXOperatorCallExpr(FnExpr, Args, 2, 
+        return Owned(new (Context) CXXOperatorCallExpr(Context, FnExpr, Args, 2, 
                                                        ResultTy, TokLoc));
       } else {
         // We matched a built-in operator. Convert the arguments, then
@@ -3897,7 +3899,7 @@
         UsualUnaryConversions(FnExpr);
 
         input.release();
-        return Owned(new (Context) CXXOperatorCallExpr(FnExpr, &Input, 1,
+        return Owned(new (Context) CXXOperatorCallExpr(Context, FnExpr, &Input, 1,
                                                        ResultTy, OpLoc));
       } else {
         // We matched a built-in operator. Convert the arguments, then
diff --git a/lib/Sema/SemaOverload.cpp b/lib/Sema/SemaOverload.cpp
index 69bbf0e..c91b507 100644
--- a/lib/Sema/SemaOverload.cpp
+++ b/lib/Sema/SemaOverload.cpp
@@ -2123,7 +2123,11 @@
                             SourceLocation());
   ImplicitCastExpr ConversionFn(Context.getPointerType(Conversion->getType()),
                                 &ConversionRef, false);
-  CallExpr Call(&ConversionFn, 0, 0, 
+  
+  // Note that it is safe to allocate CallExpr on the stack here because 
+  // there are 0 arguments (i.e., nothing is allocated using ASTContext's
+  // allocator).
+  CallExpr Call(Context, &ConversionFn, 0, 0, 
                 Conversion->getConversionType().getNonReferenceType(),
                 SourceLocation());
   ImplicitConversionSequence ICS = TryCopyInitialization(&Call, ToType, true);
@@ -3648,7 +3652,8 @@
 
   assert(Method && "Member call to something that isn't a method?");
   ExprOwningPtr<CXXMemberCallExpr> 
-    TheCall(this, new (Context) CXXMemberCallExpr(MemExpr, Args, NumArgs, 
+    TheCall(this, new (Context) CXXMemberCallExpr(Context, MemExpr, Args,
+                                                  NumArgs, 
                                   Method->getResultType().getNonReferenceType(),
                                   RParenLoc));
 
@@ -3815,7 +3820,7 @@
   // owned.
   QualType ResultTy = Method->getResultType().getNonReferenceType();
   ExprOwningPtr<CXXOperatorCallExpr> 
-    TheCall(this, new (Context) CXXOperatorCallExpr(NewFn, MethodArgs,
+    TheCall(this, new (Context) CXXOperatorCallExpr(Context, NewFn, MethodArgs,
                                                     NumArgs + 1,
                                                     ResultTy, RParenLoc));
   delete [] MethodArgs;
@@ -3928,7 +3933,7 @@
   Expr *FnExpr = new (Context) DeclRefExpr(Method, Method->getType(),
                                            SourceLocation());
   UsualUnaryConversions(FnExpr);
-  Base = new (Context) CXXOperatorCallExpr(FnExpr, &Base, 1, 
+  Base = new (Context) CXXOperatorCallExpr(Context, FnExpr, &Base, 1, 
                                  Method->getResultType().getNonReferenceType(),
                                  OpLoc);
   return ActOnMemberReferenceExpr(S, ExprArg(*this, Base), OpLoc, tok::arrow,