diff --git a/src/Makefile b/src/Makefile
index 6eed3b91..722efc33 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -292,7 +292,9 @@ ifeq (Darwin,$(TARGET_SYS))
   endif
   TARGET_STRIP+= -x
   TARGET_AR+= 2>/dev/null
-  TARGET_XCFLAGS+= -fno-stack-protector
+  ifeq (,$(shell $(TARGET_CC) -o /dev/null -c -x c /dev/null -fno-stack-protector 2>/dev/null || echo 1))
+    TARGET_XCFLAGS+= -fno-stack-protector
+  endif
   TARGET_XSHLDFLAGS= -dynamiclib -single_module -undefined dynamic_lookup -fPIC
   TARGET_DYNXLDOPTS=
   TARGET_XSHLDFLAGS+= -install_name $(TARGET_DYLIBPATH) -compatibility_version $(MAJVER).$(MINVER) -current_version $(MAJVER).$(MINVER).$(RELVER)
diff --git a/src/lib_string.c b/src/lib_string.c
index feaa7697..6ca7a76b 100644
--- a/src/lib_string.c
+++ b/src/lib_string.c
@@ -65,7 +65,7 @@ LJLIB_ASM(string_byte)		LJLIB_REC(string_range 0)
 LJLIB_ASM(string_char)		LJLIB_REC(.)
 {
   int i, nargs = (int)(L->top - L->base);
-  char *buf = lj_buf_tmp(L, (size_t)nargs);
+  char *buf = lj_buf_tmp(L, (MSize)nargs);
   for (i = 1; i <= nargs; i++) {
     int32_t k = lj_lib_checkint(L, i);
     if (!checku8(k))
diff --git a/src/lj_cconv.h b/src/lj_cconv.h
index 9b96957c..17e0f050 100644
--- a/src/lj_cconv.h
+++ b/src/lj_cconv.h
@@ -29,7 +29,7 @@ static LJ_AINLINE uint32_t cconv_idx(CTInfo info)
   uint32_t idx = ((info >> 26) & 15u);  /* Dispatch bits. */
   lua_assert(ctype_type(info) <= CT_MAYCONVERT);
 #if LJ_64
-  idx = ((U64x(f436fff5,fff7f021) >> 4*idx) & 15u);
+  idx = ((uint32_t)(U64x(f436fff5,fff7f021) >> 4*idx) & 15u);
 #else
   idx = (((idx < 8 ? 0xfff7f021u : 0xf436fff5) >> 4*(idx & 7u)) & 15u);
 #endif
diff --git a/src/lj_record.c b/src/lj_record.c
index 725b4aaf..650763fe 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -2305,7 +2305,7 @@ static const BCIns *rec_setup_root(jit_State *J)
   case BC_RET0:
   case BC_RET1:
     /* No bytecode range check for down-recursive root traces. */
-    J->maxslot = ra + bc_d(ins);
+    J->maxslot = ra + bc_d(ins) - 1;
     break;
   case BC_FUNCF:
     /* No bytecode range check for root traces started by a hot call. */