Index: include/llvm/IR/Statepoint.h
===================================================================
--- include/llvm/IR/Statepoint.h
+++ include/llvm/IR/Statepoint.h
@@ -109,9 +109,9 @@
     return StatepointCS.arg_begin() + CallArgsBeginPos;
   }
   typename CallSiteTy::arg_iterator call_args_end() {
-    int Offset = CallArgsBeginPos + getNumCallArgs();
-    assert(Offset <= (int)StatepointCS.arg_size());
-    return StatepointCS.arg_begin() + Offset;
+    auto I = call_args_begin() + getNumCallArgs();
+    assert((StatepointCS.arg_end() - I) >= 0);
+    return I;
   }
 
   /// range adapter for call arguments
@@ -121,19 +121,18 @@
 
   /// Number of GC transition args.
   int getNumTotalGCTransitionArgs() {
-    const Value *NumGCTransitionArgs = *gc_transition_args_begin();
+    const Value *NumGCTransitionArgs = *call_args_end();
     return cast<ConstantInt>(NumGCTransitionArgs)->getZExtValue();
   }
   typename CallSiteTy::arg_iterator gc_transition_args_begin() {
-    int Offset = call_args_end() - StatepointCS.arg_begin();
-    assert(Offset <= (int)StatepointCS.arg_size());
-    return StatepointCS.arg_begin() + Offset;
+    auto I = call_args_end() + 1;
+    assert((StatepointCS.arg_end() - I) >= 0);
+    return I;
   }
   typename CallSiteTy::arg_iterator gc_transition_args_end() {
-    int Offset = (gc_transition_args_begin() + 1 +
-                  getNumTotalGCTransitionArgs()) - StatepointCS.arg_begin();
-    assert(Offset <= (int)StatepointCS.arg_size());
-    return StatepointCS.arg_begin() + Offset;
+    auto I = gc_transition_args_begin() + getNumTotalGCTransitionArgs();
+    assert((StatepointCS.arg_end() - I) >= 0);
+    return I;
   }
 
   /// range adapter for GC transition arguments
@@ -145,18 +144,19 @@
   /// Number of additional arguments excluding those intended
   /// for garbage collection.
   int getNumTotalVMSArgs() {
-    Value *NumVMSArgs = *vm_state_begin();
+    const Value *NumVMSArgs = *gc_transition_args_end();
     return cast<ConstantInt>(NumVMSArgs)->getZExtValue();
   }
 
   typename CallSiteTy::arg_iterator vm_state_begin() {
-    return gc_transition_args_end();
+    auto I = gc_transition_args_end() + 1;
+    assert((StatepointCS.arg_end() - I) >= 0);
+    return I;
   }
   typename CallSiteTy::arg_iterator vm_state_end() {
-    int Offset = (gc_transition_args_end() + 1 + getNumTotalVMSArgs()) -
-                 StatepointCS.arg_begin();
-    assert(Offset <= (int)StatepointCS.arg_size());
-    return StatepointCS.arg_begin() + Offset;
+    auto I = vm_state_begin() + getNumTotalVMSArgs();
+    assert((StatepointCS.arg_end() - I) >= 0);
+    return I;
   }
 
   /// range adapter for vm state arguments
Index: lib/CodeGen/SelectionDAG/StatepointLowering.cpp
===================================================================
--- lib/CodeGen/SelectionDAG/StatepointLowering.cpp
+++ lib/CodeGen/SelectionDAG/StatepointLowering.cpp
@@ -466,10 +466,7 @@
   // particular value.  This is purely an optimization over the code below and
   // doesn't change semantics at all.  It is important for performance that we
   // reserve slots for both deopt and gc values before lowering either.
-  for (auto I = StatepointSite.vm_state_begin() + 1,
-            E = StatepointSite.vm_state_end();
-       I != E; ++I) {
-    Value *V = *I;
+  for (const Value *V : StatepointSite.vm_state_args()) {
     SDValue Incoming = Builder.getValue(V);
     reservePreviousStackSlotForValue(Incoming, Builder);
   }
@@ -490,8 +487,8 @@
   Ops.push_back(Builder.DAG.getTargetConstant(NumVMSArgs, Builder.getCurSDLoc(),
                                               MVT::i64));
 
-  assert(NumVMSArgs + 1 == std::distance(StatepointSite.vm_state_begin(),
-                                         StatepointSite.vm_state_end()));
+  assert(NumVMSArgs == std::distance(StatepointSite.vm_state_begin(),
+                                     StatepointSite.vm_state_end()));
 
   // The vm state arguments are lowered in an opaque manner.  We do
   // not know what type of values are contained within.  We skip the
@@ -499,10 +496,7 @@
   // explicitly just above.  We could have left it in the loop and
   // not done it explicitly, but it's far easier to understand this
   // way.
-  for (auto I = StatepointSite.vm_state_begin() + 1,
-            E = StatepointSite.vm_state_end();
-       I != E; ++I) {
-    const Value *V = *I;
+  for (const Value *V : StatepointSite.vm_state_args()) {
     SDValue Incoming = Builder.getValue(V);
     lowerIncomingStatepointValue(Incoming, Ops, Builder);
   }
@@ -620,12 +614,10 @@
     TSOps.push_back(Chain);
 
     // Add GC transition arguments
-    for (auto I = ISP.gc_transition_args_begin() + 1,
-              E = ISP.gc_transition_args_end();
-         I != E; ++I) {
-      TSOps.push_back(getValue(*I));
-      if ((*I)->getType()->isPointerTy())
-        TSOps.push_back(DAG.getSrcValue(*I));
+    for (const Value *V : ISP.gc_transition_args()) {
+      TSOps.push_back(getValue(V));
+      if (V->getType()->isPointerTy())
+        TSOps.push_back(DAG.getSrcValue(V));
     }
 
     // Add glue if necessary
@@ -709,12 +701,10 @@
     TEOps.push_back(SDValue(StatepointMCNode, 0));
 
     // Add GC transition arguments
-    for (auto I = ISP.gc_transition_args_begin() + 1,
-              E = ISP.gc_transition_args_end();
-         I != E; ++I) {
-      TEOps.push_back(getValue(*I));
-      if ((*I)->getType()->isPointerTy())
-        TEOps.push_back(DAG.getSrcValue(*I));
+    for (const Value *V : ISP.gc_transition_args()) {
+      TEOps.push_back(getValue(V));
+      if (V->getType()->isPointerTy())
+        TEOps.push_back(DAG.getSrcValue(V));
     }
 
     // Add glue