numCalleeLocals, numParameters, and numVars should be unsigned

https://bugs.webkit.org/show_bug.cgi?id=224995

Reviewed by Mark Lam.

All of the various CodeBlock classes currently have the
numCalleeLocals and numVars marked as ints. I believe this is just
a historical artifact or because VirtualRegister's offset is an
int to make handling constants easier. Regardless, it's a bit
strange to not handle the sign conversion at the point of
comparison between a VirtualRegister offset and the local/var
count. This doesn't completely fix every place we use ints for
these values but starts on the right track. Lastly, I also added
some Check<unsigned>s to the wasm parser for sanity checking.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::setNumParameters):
(JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeIndexSlow):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::numParameters const):
(JSC::CodeBlock::numberOfArgumentsToSkip const):
(JSC::CodeBlock::numCalleeLocals const):
(JSC::CodeBlock::numVars const):
(JSC::CodeBlock::numTmps const):
(JSC::CodeBlock::addressOfNumParameters):
(JSC::CodeBlock::isTemporaryRegister):
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::numCalleeLocals const):
(JSC::UnlinkedCodeBlock::numVars const):
* bytecode/UnlinkedCodeBlockGenerator.h:
(JSC::UnlinkedCodeBlockGenerator::numCalleeLocals const):
(JSC::UnlinkedCodeBlockGenerator::numVars const):
(JSC::UnlinkedCodeBlockGenerator::setNumCalleeLocals):
(JSC::UnlinkedCodeBlockGenerator::setNumVars):
(JSC::UnlinkedCodeBlockGenerator::setNumParameters):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::generate):
(JSC::BytecodeGenerator::emitPushFunctionNameScope):
* bytecompiler/BytecodeGeneratorBaseInlines.h:
(JSC::BytecodeGeneratorBase<Traits>::newRegister):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
(JSC::DFG::ByteCodeParser::inliningCost):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGOSREntrypointCreationPhase.cpp:
(JSC::DFG::OSREntrypointCreationPhase::run):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::lower):
* ftl/FTLOSREntry.cpp:
(JSC::FTL::prepareOSREntry):
* interpreter/CallFrameClosure.h:
* interpreter/ProtoCallFrameInlines.h:
(JSC::ProtoCallFrame::init):
* jit/JIT.cpp:
(JSC::JIT::compileWithoutLinking):
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::numberOfStackPaddingSlots):
(JSC::CommonSlowPaths::numberOfStackPaddingSlotsWithExtraSlots):
* wasm/WasmFunctionCodeBlock.h:
(JSC::Wasm::FunctionCodeBlock::numVars const):
(JSC::Wasm::FunctionCodeBlock::numCalleeLocals const):
(JSC::Wasm::FunctionCodeBlock::setNumVars):
(JSC::Wasm::FunctionCodeBlock::setNumCalleeLocals):
* wasm/WasmLLIntGenerator.cpp:
(JSC::Wasm::LLIntGenerator::push):
(JSC::Wasm::LLIntGenerator::getDropKeepCount):
(JSC::Wasm::LLIntGenerator::walkExpressionStack):
(JSC::Wasm::LLIntGenerator::checkConsistency):
(JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals):
(JSC::Wasm::LLIntGenerator::splitStack):
(JSC::Wasm::LLIntGenerator::finalize):
(JSC::Wasm::LLIntGenerator::callInformationForCaller):
(JSC::Wasm::LLIntGenerator::addLoop):
(JSC::Wasm::LLIntGenerator::addTopLevel):
(JSC::Wasm::LLIntGenerator::addBlock):
(JSC::Wasm::LLIntGenerator::addIf):
(JSC::Wasm::LLIntGenerator::addElseToUnreachable):


Canonical link: https://commits.webkit.org/237038@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@276609 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,85 @@
+2021-04-26  Keith Miller  <keith_miller@apple.com>
+
+        numCalleeLocals, numParameters, and numVars should be unsigned
+        https://bugs.webkit.org/show_bug.cgi?id=224995
+
+        Reviewed by Mark Lam.
+
+        All of the various CodeBlock classes currently have the
+        numCalleeLocals and numVars marked as ints. I believe this is just
+        a historical artifact or because VirtualRegister's offset is an
+        int to make handling constants easier. Regardless, it's a bit
+        strange to not handle the sign conversion at the point of
+        comparison between a VirtualRegister offset and the local/var
+        count. This doesn't completely fix every place we use ints for
+        these values but starts on the right track. Lastly, I also added
+        some Check<unsigned>s to the wasm parser for sanity checking.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::setNumParameters):
+        (JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeIndexSlow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numParameters const):
+        (JSC::CodeBlock::numberOfArgumentsToSkip const):
+        (JSC::CodeBlock::numCalleeLocals const):
+        (JSC::CodeBlock::numVars const):
+        (JSC::CodeBlock::numTmps const):
+        (JSC::CodeBlock::addressOfNumParameters):
+        (JSC::CodeBlock::isTemporaryRegister):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::numCalleeLocals const):
+        (JSC::UnlinkedCodeBlock::numVars const):
+        * bytecode/UnlinkedCodeBlockGenerator.h:
+        (JSC::UnlinkedCodeBlockGenerator::numCalleeLocals const):
+        (JSC::UnlinkedCodeBlockGenerator::numVars const):
+        (JSC::UnlinkedCodeBlockGenerator::setNumCalleeLocals):
+        (JSC::UnlinkedCodeBlockGenerator::setNumVars):
+        (JSC::UnlinkedCodeBlockGenerator::setNumParameters):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        * bytecompiler/BytecodeGeneratorBaseInlines.h:
+        (JSC::BytecodeGeneratorBase<Traits>::newRegister):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/ProtoCallFrameInlines.h:
+        (JSC::ProtoCallFrame::init):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::numberOfStackPaddingSlots):
+        (JSC::CommonSlowPaths::numberOfStackPaddingSlotsWithExtraSlots):
+        * wasm/WasmFunctionCodeBlock.h:
+        (JSC::Wasm::FunctionCodeBlock::numVars const):
+        (JSC::Wasm::FunctionCodeBlock::numCalleeLocals const):
+        (JSC::Wasm::FunctionCodeBlock::setNumVars):
+        (JSC::Wasm::FunctionCodeBlock::setNumCalleeLocals):
+        * wasm/WasmLLIntGenerator.cpp:
+        (JSC::Wasm::LLIntGenerator::push):
+        (JSC::Wasm::LLIntGenerator::getDropKeepCount):
+        (JSC::Wasm::LLIntGenerator::walkExpressionStack):
+        (JSC::Wasm::LLIntGenerator::checkConsistency):
+        (JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals):
+        (JSC::Wasm::LLIntGenerator::splitStack):
+        (JSC::Wasm::LLIntGenerator::finalize):
+        (JSC::Wasm::LLIntGenerator::callInformationForCaller):
+        (JSC::Wasm::LLIntGenerator::addLoop):
+        (JSC::Wasm::LLIntGenerator::addTopLevel):
+        (JSC::Wasm::LLIntGenerator::addBlock):
+        (JSC::Wasm::LLIntGenerator::addIf):
+        (JSC::Wasm::LLIntGenerator::addElseToUnreachable):
+
 2021-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
 
         [JSC] OrdinarySet should invoke custom [[Set]] methods

Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -924,7 +924,7 @@ void CodeBlock::setAlternative(VM& vm, CodeBlock* alternative)
     m_alternative.set(vm, this, alternative);
 }
 
-void CodeBlock::setNumParameters(int newValue)
+void CodeBlock::setNumParameters(unsigned newValue)
 {
     m_numParameters = newValue;
 
@@ -2015,7 +2015,7 @@ void CodeBlock::ensureCatchLivenessIsComputedForBytecodeIndexSlow(const OpCatch&
         liveOperands.append(virtualRegisterForLocal(liveLocal));
     });
 
-    for (int i = 0; i < numParameters(); ++i)
+    for (unsigned i = 0; i < numParameters(); ++i)
         liveOperands.append(virtualRegisterForArgumentIncludingThis(i));
 
     auto* profiles = ValueProfileAndVirtualRegisterBuffer::create(liveOperands.size());

Source/JavaScriptCore/bytecode/CodeBlock.h

@@ -156,17 +156,17 @@ class CodeBlock : public JSCell {
 
     MetadataTable* metadataTable() const { return m_metadata.get(); }
 
-    int numParameters() const { return m_numParameters; }
-    void setNumParameters(int newValue);
+    unsigned numParameters() const { return m_numParameters; }
+    void setNumParameters(unsigned newValue);
 
-    int numberOfArgumentsToSkip() const { return m_numberOfArgumentsToSkip; }
+    unsigned numberOfArgumentsToSkip() const { return m_numberOfArgumentsToSkip; }
 
-    int numCalleeLocals() const { return m_numCalleeLocals; }
+    unsigned numCalleeLocals() const { return m_numCalleeLocals; }
 
-    int numVars() const { return m_numVars; }
-    int numTmps() const { return m_unlinkedCode->hasCheckpoints() * maxNumCheckpointTmps; }
+    unsigned numVars() const { return m_numVars; }
+    unsigned numTmps() const { return m_unlinkedCode->hasCheckpoints() * maxNumCheckpointTmps; }
 
-    int* addressOfNumParameters() { return &m_numParameters; }
+    unsigned* addressOfNumParameters() { return &m_numParameters; }
     static ptrdiff_t offsetOfNumParameters() { return OBJECT_OFFSETOF(CodeBlock, m_numParameters); }
 
     CodeBlock* alternative() const { return static_cast<CodeBlock*>(m_alternative.get()); }
@@ -243,7 +243,7 @@ class CodeBlock : public JSCell {
 
     ALWAYS_INLINE bool isTemporaryRegister(VirtualRegister reg)
     {
-        return reg.offset() >= m_numVars;
+        return reg.offset() >= static_cast<int>(m_numVars);
     }
 
     HandlerInfo* handlerForBytecodeIndex(BytecodeIndex, RequiredHandler = RequiredHandler::AnyHandler);
@@ -989,10 +989,10 @@ class CodeBlock : public JSCell {
     void insertBasicBlockBoundariesForControlFlowProfiler();
     void ensureCatchLivenessIsComputedForBytecodeIndexSlow(const OpCatch&, BytecodeIndex);
 
-    int m_numCalleeLocals;
-    int m_numVars;
-    int m_numParameters;
-    int m_numberOfArgumentsToSkip { 0 };
+    unsigned m_numCalleeLocals;
+    unsigned m_numVars;
+    unsigned m_numParameters;
+    unsigned m_numberOfArgumentsToSkip { 0 };
     unsigned m_numberOfNonArgumentValueProfiles { 0 };
     union {
         unsigned m_debuggerRequests;

Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h

@@ -209,8 +209,8 @@ class UnlinkedCodeBlock : public JSCell {
 
     const InstructionStream& instructions() const;
 
-    int numCalleeLocals() const { return m_numCalleeLocals; }
-    int numVars() const { return m_numVars; }
+    unsigned numCalleeLocals() const { return m_numCalleeLocals; }
+    unsigned numVars() const { return m_numVars; }
 
     // Jump Tables
 
@@ -396,9 +396,9 @@ class UnlinkedCodeBlock : public JSCell {
     unsigned m_lineCount { 0 };
     unsigned m_endColumn { UINT_MAX };
 
-    int m_numVars { 0 };
-    int m_numCalleeLocals { 0 };
-    int m_numParameters { 0 };
+    unsigned m_numVars { 0 };
+    unsigned m_numCalleeLocals { 0 };
+    unsigned m_numParameters { 0 };
 
     PackedRefPtr<StringImpl> m_sourceURLDirective;
     PackedRefPtr<StringImpl> m_sourceMappingURLDirective;

Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h

@@ -59,8 +59,8 @@ class UnlinkedCodeBlockGenerator {
     EvalContextType evalContextType() const { return m_codeBlock->evalContextType(); }
     bool isArrowFunctionContext() const { return m_codeBlock->isArrowFunctionContext(); }
     bool isClassContext() const { return m_codeBlock->isClassContext(); }
-    int numCalleeLocals() const { return m_codeBlock->m_numCalleeLocals; }
-    int numVars() const { return m_codeBlock->m_numVars; }
+    unsigned numCalleeLocals() const { return m_codeBlock->m_numCalleeLocals; }
+    unsigned numVars() const { return m_codeBlock->m_numVars; }
     unsigned numParameters() const { return m_codeBlock->numParameters(); }
     VirtualRegister thisRegister() const { return m_codeBlock->thisRegister(); }
     VirtualRegister scopeRegister() const { return m_codeBlock->scopeRegister(); }
@@ -71,11 +71,11 @@ class UnlinkedCodeBlockGenerator {
     // Updating UnlinkedCodeBlock.
     void setHasCheckpoints() { m_codeBlock->setHasCheckpoints(); }
     void setHasTailCalls() { m_codeBlock->setHasTailCalls(); }
-    void setNumCalleeLocals(int numCalleeLocals) { m_codeBlock->m_numCalleeLocals = numCalleeLocals; }
-    void setNumVars(int numVars) { m_codeBlock->m_numVars = numVars; }
+    void setNumCalleeLocals(unsigned numCalleeLocals) { m_codeBlock->m_numCalleeLocals = numCalleeLocals; }
+    void setNumVars(unsigned numVars) { m_codeBlock->m_numVars = numVars; }
     void setThisRegister(VirtualRegister thisRegister) { m_codeBlock->setThisRegister(thisRegister); }
     void setScopeRegister(VirtualRegister thisRegister) { m_codeBlock->setScopeRegister(thisRegister); }
-    void setNumParameters(int newValue) { m_codeBlock->setNumParameters(newValue); }
+    void setNumParameters(unsigned newValue) { m_codeBlock->setNumParameters(newValue); }
 
     UnlinkedMetadataTable& metadata() { return m_codeBlock->metadata(); }
     void addExpressionInfo(unsigned instructionOffset, int divot, int startOffset, int endOffset, unsigned line, unsigned column);

Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

@@ -282,7 +282,7 @@ ParserError BytecodeGenerator::generate()
     if (m_isAsync)
         performGeneratorification(*this, m_codeBlock.get(), m_writer, m_generatorFrameSymbolTable.get(), m_generatorFrameSymbolTableIndex);
 
-    RELEASE_ASSERT(static_cast<unsigned>(m_codeBlock->numCalleeLocals()) < static_cast<unsigned>(FirstConstantRegisterIndex));
+    RELEASE_ASSERT(m_codeBlock->numCalleeLocals() < static_cast<unsigned>(FirstConstantRegisterIndex));
     m_codeBlock->finalize(m_writer.finalize());
     if (m_expressionTooDeep)
         return ParserError(ParserError::OutOfMemory);
@@ -3987,7 +3987,7 @@ void BytecodeGenerator::emitPushFunctionNameScope(const Identifier& property, Re
     addResult.iterator->value.setIsConst(); // The function name scope name acts like a const variable.
     unsigned numVars = m_codeBlock->numVars();
     pushLexicalScopeInternal(nameScopeEnvironment, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, TDZRequirement::NotUnderTDZ, ScopeType::FunctionNameScope, ScopeRegisterType::Var);
-    ASSERT_UNUSED(numVars, m_codeBlock->numVars() == static_cast<int>(numVars + 1)); // Should have only created one new "var" for the function name scope.
+    ASSERT_UNUSED(numVars, m_codeBlock->numVars() == numVars + 1); // Should have only created one new "var" for the function name scope.
     bool shouldTreatAsLexicalVariable = ecmaMode().isStrict();
     Variable functionVar = variableForLocalEntry(property, m_lexicalScopeStack.last().m_symbolTable->get(NoLockingNecessary, property.impl()), m_lexicalScopeStack.last().m_symbolTableConstantIndex, shouldTreatAsLexicalVariable);
     emitPutToScope(m_lexicalScopeStack.last().m_scope, functionVar, callee, ThrowIfNotFound, InitializationMode::NotInitialization);

Source/JavaScriptCore/bytecompiler/BytecodeGeneratorBaseInlines.h

@@ -161,9 +161,10 @@ template<typename Traits>
 RegisterID* BytecodeGeneratorBase<Traits>::newRegister()
 {
     m_calleeLocals.append(virtualRegisterForLocal(m_calleeLocals.size()));
-    int numCalleeLocals = std::max<int>(m_codeBlock->numCalleeLocals(), m_calleeLocals.size());
+    size_t numCalleeLocals = std::max<size_t>(m_codeBlock->numCalleeLocals(), m_calleeLocals.size());
     numCalleeLocals = WTF::roundUpToMultipleOf(stackAlignmentRegisters(), numCalleeLocals);
-    m_codeBlock->setNumCalleeLocals(numCalleeLocals);
+    m_codeBlock->setNumCalleeLocals(static_cast<unsigned>(numCalleeLocals));
+    RELEASE_ASSERT(numCalleeLocals == m_codeBlock->numCalleeLocals());
     return &m_calleeLocals.last();
 }
 

Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -1494,7 +1494,7 @@ bool ByteCodeParser::handleRecursiveTailCall(Node* callTargetNode, CallVariant c
 
             // Some code may statically use the argument count from the InlineCallFrame, so it would be invalid to loop back if it does not match.
             // We "continue" instead of returning false in case another stack entry further on the stack has the right number of arguments.
-            if (argumentCountIncludingThis != static_cast<int>(callFrame->argumentCountIncludingThis))
+            if (argumentCountIncludingThis != callFrame->argumentCountIncludingThis)
                 continue;
             // If the target InlineCallFrame is Varargs, we do not know how many arguments are actually filled by LoadVarargs. Varargs InlineCallFrame's
             // argumentCountIncludingThis is maximum number of potentially filled arguments by xkLoadVarargs. We "continue" to the upper frame which may be
@@ -1504,7 +1504,7 @@ bool ByteCodeParser::handleRecursiveTailCall(Node* callTargetNode, CallVariant c
         } else {
             // We are in the machine code entry (i.e. the original caller).
             // If we have more arguments than the number of parameters to the function, it is not clear where we could put them on the stack.
-            if (argumentCountIncludingThis > m_codeBlock->numParameters())
+            if (static_cast<unsigned>(argumentCountIncludingThis) > m_codeBlock->numParameters())
                 return false;
         }
 
@@ -1530,8 +1530,8 @@ bool ByteCodeParser::handleRecursiveTailCall(Node* callTargetNode, CallVariant c
         // We must set the arguments to the right values
         if (!stackEntry->m_inlineCallFrame)
             addToGraph(SetArgumentCountIncludingThis, OpInfo(argumentCountIncludingThis));
-        int argIndex = 0;
-        for (; argIndex < argumentCountIncludingThis; ++argIndex) {
+        unsigned argIndex = 0;
+        for (; argIndex < static_cast<unsigned>(argumentCountIncludingThis); ++argIndex) {
             Node* value = get(virtualRegisterForArgumentIncludingThis(argIndex, registerOffset));
             setDirect(stackEntry->remapOperand(virtualRegisterForArgumentIncludingThis(argIndex)), value, NormalSet);
         }
@@ -1541,7 +1541,7 @@ bool ByteCodeParser::handleRecursiveTailCall(Node* callTargetNode, CallVariant c
 
         // We must repeat the work of op_enter here as we will jump right after it.
         // We jump right after it and not before it, because of some invariant saying that a CFG root cannot have predecessors in the IR.
-        for (int i = 0; i < stackEntry->m_codeBlock->numVars(); ++i)
+        for (unsigned i = 0; i < stackEntry->m_codeBlock->numVars(); ++i)
             setDirect(stackEntry->remapOperand(virtualRegisterForLocal(i)), undefined, NormalSet);
 
         // We want to emit the SetLocals with an exit origin that points to the place we are jumping to.
@@ -1597,7 +1597,7 @@ unsigned ByteCodeParser::inliningCost(CallVariant callee, int argumentCountInclu
     }
 
     if (!Options::useArityFixupInlining()) {
-        if (codeBlock->numParameters() > argumentCountIncludingThis) {
+        if (codeBlock->numParameters() > static_cast<unsigned>(argumentCountIncludingThis)) {
             VERBOSE_LOG("    Failing because of arity mismatch.\n");
             return UINT_MAX;
         }
@@ -5418,7 +5418,7 @@ void ByteCodeParser::parseBlock(unsigned limit)
         case op_enter: {
             Node* undefined = addToGraph(JSConstant, OpInfo(m_constantUndefined));
             // Initialize all locals to undefined.
-            for (int i = 0; i < m_inlineStackTop->m_codeBlock->numVars(); ++i)
+            for (unsigned i = 0; i < m_inlineStackTop->m_codeBlock->numVars(); ++i)
                 set(virtualRegisterForLocal(i), undefined, ImmediateNakedSet);
 
             NEXT_OPCODE(op_enter);

Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp

@@ -94,7 +94,7 @@ class OSREntrypointCreationPhase : public Phase {
         NodeOrigin origin = NodeOrigin(CodeOrigin(BytecodeIndex(0)), CodeOrigin(BytecodeIndex(0)), false);
 
         Vector<Node*> locals(baseline->numCalleeLocals());
-        for (int local = 0; local < baseline->numCalleeLocals(); ++local) {
+        for (unsigned local = 0; local < baseline->numCalleeLocals(); ++local) {
             Node* previousHead = target->variablesAtHead.local(local);
             if (!previousHead)
                 continue;
@@ -113,7 +113,7 @@ class OSREntrypointCreationPhase : public Phase {
         origin = target->at(0)->origin;
 
         ArgumentsVector newArguments = m_graph.m_rootToArguments.find(m_graph.block(0))->value;
-        for (int argument = 0; argument < baseline->numParameters(); ++argument) {
+        for (unsigned argument = 0; argument < baseline->numParameters(); ++argument) {
             Node* oldNode = target->variablesAtHead.argument(argument);
             if (!oldNode) {
                 // Just for sanity, always have a SetArgumentDefinitely even if it's not needed.
@@ -125,7 +125,7 @@ class OSREntrypointCreationPhase : public Phase {
             newArguments[argument] = node;
         }
 
-        for (int local = 0; local < baseline->numCalleeLocals(); ++local) {
+        for (unsigned local = 0; local < baseline->numCalleeLocals(); ++local) {
             Node* previousHead = target->variablesAtHead.local(local);
             if (!previousHead)
                 continue;

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -2079,7 +2079,7 @@ void SpeculativeJIT::checkArgumentTypes()
     m_origin = NodeOrigin(CodeOrigin(BytecodeIndex(0)), CodeOrigin(BytecodeIndex(0)), true);
 
     auto& arguments = m_jit.graph().m_rootToArguments.find(m_jit.graph().block(0))->value;
-    for (int i = 0; i < m_jit.codeBlock()->numParameters(); ++i) {
+    for (unsigned i = 0; i < m_jit.codeBlock()->numParameters(); ++i) {
         Node* node = arguments[i];
         if (!node) {
             // The argument is dead. We don't do any checks for such arguments.

Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -362,7 +362,7 @@ class LowerDFGToB3 {
             if (m_graph.m_plan.mode() == FTLForOSREntryMode) {
                 auto* jitCode = m_ftlState.jitCode->ftlForOSREntry();
                 FixedVector<DFG::FlushFormat> argumentFlushFormats(codeBlock()->numParameters());
-                for (int i = 0; i < codeBlock()->numParameters(); ++i)
+                for (unsigned i = 0; i < codeBlock()->numParameters(); ++i)
                     argumentFlushFormats[i] = m_graph.m_argumentFormats[0][i];
                 jitCode->setArgumentFlushFormats(WTFMove(argumentFlushFormats));
             } else {

Source/JavaScriptCore/ftl/FTLOSREntry.cpp

@@ -113,8 +113,7 @@ void* prepareOSREntry(
         RELEASE_ASSERT_NOT_REACHED();
     }
 
-    RELEASE_ASSERT(
-        static_cast<int>(values.numberOfLocals()) == baseline->numCalleeLocals());
+    RELEASE_ASSERT(values.numberOfLocals() == baseline->numCalleeLocals());
 
     EncodedJSValue* scratch = static_cast<EncodedJSValue*>(
         entryCode->entryBuffer()->dataBuffer());

Source/JavaScriptCore/interpreter/CallFrameClosure.h

@@ -36,7 +36,7 @@ struct CallFrameClosure {
     FunctionExecutable* functionExecutable;
     VM* vm;
     JSScope* scope;
-    int parameterCountIncludingThis;
+    unsigned parameterCountIncludingThis;
     int argumentCountIncludingThis;
 
     void setThis(JSValue value)

Source/JavaScriptCore/interpreter/ProtoCallFrameInlines.h

@@ -37,7 +37,7 @@ inline void ProtoCallFrame::init(CodeBlock* codeBlock, JSGlobalObject* globalObj
     this->setCallee(callee);
     this->setGlobalObject(globalObject);
     this->setArgumentCountIncludingThis(argCountIncludingThis);
-    if (codeBlock && argCountIncludingThis < codeBlock->numParameters())
+    if (codeBlock && static_cast<unsigned>(argCountIncludingThis) < codeBlock->numParameters())
         this->hasArityMismatch = true;
     else
         this->hasArityMismatch = false;