[builtins] Fix unsigned comparison in InterpreterPushArgs loop

This is a loop over an address range; the loop condition was
incorrectly implemented as a signed comparison.

Bug: chromium:876210
Change-Id: If7276d8ba50f46600f2dfc31268fd02cbb173f15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1985997Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65664}

src/builtins/arm/builtins-arm.cc

@@ -1190,7 +1190,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ push(scratch);
   __ bind(&loop_check);
   __ cmp(index, limit);
-  __ b(gt, &loop_header);
+  __ b(hi, &loop_header);
 }
 
 // static

src/builtins/ia32/builtins-ia32.cc

@@ -1137,7 +1137,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ sub(start_address, Immediate(kSystemPointerSize));
   __ bind(&loop_check);
   __ cmp(start_address, array_limit);
-  __ j(greater, &loop_header, Label::kNear);
+  __ j(above, &loop_header, Label::kNear);
 }
 
 // static

src/builtins/mips/builtins-mips.cc

@@ -1170,7 +1170,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ Addu(index, index, Operand(-kPointerSize));
   __ push(scratch);
   __ bind(&loop_check);
-  __ Branch(&loop_header, gt, index, Operand(scratch2));
+  __ Branch(&loop_header, hi, index, Operand(scratch2));
 }
 
 // static

src/builtins/mips64/builtins-mips64.cc

@@ -1189,7 +1189,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ Daddu(index, index, Operand(-kPointerSize));
   __ push(scratch);
   __ bind(&loop_check);
-  __ Branch(&loop_header, gt, index, Operand(scratch2));
+  __ Branch(&loop_header, hi, index, Operand(scratch2));
 }
 
 // static

src/builtins/x64/builtins-x64.cc

@@ -1238,7 +1238,7 @@ static void Generate_InterpreterPushArgs(MacroAssembler* masm,
   __ subq(start_address, Immediate(kSystemPointerSize));
   __ bind(&loop_check);
   __ cmpq(start_address, scratch);
-  __ j(greater, &loop_header, Label::kNear);
+  __ j(above, &loop_header, Label::kNear);
 }
 
 // static