diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php
index 7ed3cbd..bdef4a8 100644
--- a/core/modules/user/src/AccountForm.php
+++ b/core/modules/user/src/AccountForm.php
@@ -46,7 +46,7 @@
    *   The entity manager.
    * @param \Drupal\Core\Language\LanguageManagerInterface $language_manager
    *   The language manager.
-   * @param \Drupal\Core\Entity\Query\QueryFactory
+   * @param \Drupal\Core\Entity\Query\QueryFactory $entity_query
    *   The entity query factory.
    */
   public function __construct(EntityManagerInterface $entity_manager, LanguageManagerInterface $language_manager, QueryFactory $entity_query) {
diff --git a/core/modules/user/src/Tests/UserLoginTest.php b/core/modules/user/src/Tests/UserLoginTest.php
index 0235983..949ec2e 100644
--- a/core/modules/user/src/Tests/UserLoginTest.php
+++ b/core/modules/user/src/Tests/UserLoginTest.php
@@ -140,11 +140,14 @@ function testPasswordRehashOnLogin() {
   /**
    * Make an unsuccessful login attempt.
    *
-   * @param $account
+   * @param \Drupal\user\Entity\User $account
    *   A user object with name and pass_raw attributes for the login attempt.
-   * @param $flood_trigger
-   *   Whether or not to expect that the flood control mechanism will be
-   *   triggered.
+   * @param mixed $flood_trigger
+   *   (optional) Whether or not to expect that the flood control mechanism will
+   *   be triggered. Defaults to NULL.
+   *   - Set to 'user' to expect a 'too many failed logins error.
+   *   - Set to any value to expect an error for too many failed logins per IP.
+   *   - Set to NULL to expect a failed login.
    */
   function assertFailedLogin($account, $flood_trigger = NULL) {
     $edit = array(
diff --git a/core/modules/user/user.api.php b/core/modules/user/user.api.php
index 928a56a..48faffb 100644
--- a/core/modules/user/user.api.php
+++ b/core/modules/user/user.api.php
@@ -28,11 +28,11 @@
  * Expensive operations should be added to the global account cancellation batch
  * by using batch_set().
  *
- * @param $edit
+ * @param array $edit
  *   The array of form values submitted by the user.
- * @param $account
+ * @param object $account
  *   The user object on which the operation is being performed.
- * @param $method
+ * @param string $method
  *   The account cancellation method.
  *
  * @see user_cancel_methods()
@@ -81,7 +81,7 @@ function hook_user_cancel($edit, $account, $method) {
  *   a method. If 'access' is defined, the method cannot be configured as
  *   default method.
  *
- * @param $methods
+ * @param array $methods
  *   An array containing user account cancellation methods, keyed by method id.
  *
  * @see user_cancel_methods()
@@ -111,10 +111,10 @@ function hook_user_cancel_methods_alter(&$methods) {
  * displayed. Can be used to ensure user privacy in situations where
  * $account->name is too revealing.
  *
- * @param $name
+ * @param string $name
  *   The string that user_format_name() will return.
  *
- * @param $account
+ * @param object $account
  *   The account object passed to user_format_name().
  *
  * @see user_format_name()
@@ -129,7 +129,7 @@ function hook_user_format_name_alter(&$name, $account) {
 /**
  * The user just logged in.
  *
- * @param $account
+ * @param object $account
  *   The user object on which the operation was just performed.
  */
 function hook_user_login($account) {
@@ -143,7 +143,7 @@ function hook_user_login($account) {
 /**
  * The user just logged out.
  *
- * @param $account
+ * @param object $account
  *   The user object on which the operation was just performed.
  */
 function hook_user_logout($account) {
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index 86c063d..b0bc699 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -395,7 +395,7 @@ function _user_role_permissions_update($roles) {
 /**
  * Checks for usernames blocked by user administration.
  *
- * @param $name
+ * @param string $name
  *   A string containing a name of the user.
  *
  * @return bool
@@ -460,10 +460,10 @@ function user_preprocess_block(&$variables) {
 /**
  * Format a username.
  *
- * @param \Drupal\Core\Session\Interface $account
+ * @param \Drupal\Core\Session\AccountInterface $account
  *   The account object for the user whose name is to be formatted.
  *
- * @return
+ * @return string
  *   An unsanitized string with the username to display. The code receiving
  *   this result must ensure that \Drupal\Component\Utility\String::checkPlain()
  *   is called on it before it is printed to the page.
@@ -503,14 +503,14 @@ function user_template_preprocess_default_variables_alter(&$variables) {
  *
  * Default template: username.html.twig.
  *
- * @param array $variables
- *   An associative array containing:
- *   - account: The user account (Drupal\user\Plugin\Core\Entity\User).
- *
  * Modules that make any changes to variables like 'name' or 'extra' must ensure
  * that the final string is safe to include directly in the output by using
  * \Drupal\Component\Utility\String::checkPlain() or
  * \Drupal\Component\Utility\Xss::filter().
+ *
+ * @param array $variables
+ *   An associative array containing:
+ *   - account: The user account (\Drupal\Core\Session\AccountInterface).
  */
 function template_preprocess_username(&$variables) {
   $account = $variables['account'] ?: new AnonymousUserSession();
@@ -635,7 +635,7 @@ function user_user_logout($account) {
 /**
  * Generates a unique URL for a user to login and reset their password.
  *
- * @param object $account
+ * @param \Drupal\user\UserInterface $account
  *   An object containing the user account, which must contain at least the
  *   following properties:
  *   - uid: The user ID number.
@@ -645,7 +645,7 @@ function user_user_logout($account) {
  *   - langcode: A language code to be used when generating locale-sensitive
  *    URLs. If langcode is NULL the users preferred language is used.
  *
- * @return
+ * @return string
  *   A unique URL that provides a one-time log in for the user, from which
  *   they can change their password.
  */
@@ -668,7 +668,7 @@ function user_pass_reset_url($account, $options = array()) {
 /**
  * Generates a URL to confirm an account cancellation request.
  *
- * @param object $account
+ * @param \Drupal\user\UserInterface $account
  *   The user account object, which must contain at least the following
  *   properties:
  *   - uid: The user ID number.
@@ -679,7 +679,7 @@ function user_pass_reset_url($account, $options = array()) {
  *   - langcode: A language code to be used when generating locale-sensitive
  *     URLs. If langcode is NULL the users preferred language is used.
  *
- * @return
+ * @return string
  *   A unique URL that may be used to confirm the cancellation of the user
  *   account.
  *
@@ -716,7 +716,7 @@ function user_cancel_url($account, $options = array()) {
  * @param int $login
  *   The UNIX timestamp of the user's last login.
  *
- * @return
+ * @return string
  *   A string that is safe for use in URLs and SQL statements.
  */
 function user_pass_rehash($password, $timestamp, $login) {
@@ -730,11 +730,11 @@ function user_pass_rehash($password, $timestamp, $login) {
  * Form API will invoke it, or batch_process() needs to be invoked after calling
  * this function and should define the path to redirect to.
  *
- * @param $edit
+ * @param array $edit
  *   An array of submitted form values.
- * @param $uid
+ * @param int $uid
  *   The user ID of the user account to cancel.
- * @param $method
+ * @param string $method
  *   The account cancellation method to use.
  *
  * @see _user_cancel()
@@ -791,6 +791,13 @@ function user_cancel($edit, $uid, $method) {
  * Since batch and session API require a valid user account, the actual
  * cancellation of a user account needs to happen last.
  *
+ * @param array $edit
+ *   An array of submitted form values.
+ * @param \Drupal\user\UserInterface $account
+ *   The user ID of the user account to cancel.
+ * @param string $method
+ *   The account cancellation method to use.
+ *
  * @see user_cancel()
  */
 function _user_cancel($edit, $account, $method) {
@@ -902,7 +909,7 @@ function user_cancel_methods() {
 /**
  * Delete a user.
  *
- * @param $uid
+ * @param int $uid
  *   A user ID.
  */
 function user_delete($uid) {
@@ -912,7 +919,7 @@ function user_delete($uid) {
 /**
  * Delete multiple user accounts.
  *
- * @param $uids
+ * @param int[] $uids
  *   An array of user IDs.
  *
  * @see hook_ENTITY_TYPE_predelete()
@@ -935,15 +942,15 @@ function user_delete_multiple(array $uids) {
  * To theme user profiles, copy core/modules/user/templates/user.html.twig
  * to your theme directory, and edit it as instructed in that file's comments.
  *
- * @param $account
+ * @param \Drupal\user\UserInterface $account
  *   A user object.
- * @param $view_mode
+ * @param string $view_mode
  *   View mode, e.g. 'full'.
- * @param $langcode
+ * @param string|null $langcode
  *   (optional) A language code to use for rendering. Defaults to the global
  *   content language of the current request.
  *
- * @return
+ * @return array
  *   An array as expected by drupal_render().
  */
 function user_view($account, $view_mode = 'full', $langcode = NULL) {
@@ -953,15 +960,15 @@ function user_view($account, $view_mode = 'full', $langcode = NULL) {
 /**
  * Constructs a drupal_render() style array from an array of loaded users.
  *
- * @param $accounts
+ * @param \Drupal\user\UserInterface[] $account
  *   An array of user accounts as returned by user_load_multiple().
- * @param $view_mode
- *   (optional) View mode, e.g., 'full', 'teaser'... Defaults to 'teaser.'
- * @param $langcode
+ * @param string $view_mode
+ *   (optional) View mode, e.g., 'full', 'teaser'... Defaults to 'teaser'.
+ * @param string|null $langcode
  *   (optional) A language code to use for rendering. Defaults to the global
  *   content language of the current request.
  *
- * @return
+ * @return array
  *   An array in the format expected by drupal_render().
  */
 function user_view_multiple($accounts, $view_mode = 'full', $langcode = NULL) {
@@ -999,17 +1006,18 @@ function user_mail($key, &$message, $params) {
  * some additional tokens that can be used in email messages generated by
  * user_mail().
  *
- * @param $replacements
+ * @param array $replacements
  *   An associative array variable containing mappings from token names to
  *   values (for use with strtr()).
- * @param $data
+ * @param array $data
  *   An associative array of token replacement values. If the 'user' element
  *   exists, it must contain a user account object with the following
  *   properties:
  *   - login: The UNIX timestamp of the user's last login.
  *   - pass: The hashed account login password.
- * @param $options
- *   Unused parameter required by \Drupal\Core\Utility\Token::replace().
+ * @param array $options
+ *   A keyed array of settings and flags to control the token replacement
+ *   process. See \Drupal\Core\Utility\Token::replace().
  */
 function user_mail_tokens(&$replacements, $data, $options) {
   if (isset($data['user'])) {
@@ -1021,15 +1029,16 @@ function user_mail_tokens(&$replacements, $data, $options) {
 /*** Administrative features ***********************************************/
 
 /**
- * Retrieve an array of roles matching specified conditions.
+ * Retrieve the names of roles matching specified conditions.
  *
- * @param $membersonly
- *   Set this to TRUE to exclude the 'anonymous' role.
- * @param $permission
- *   A string containing a permission. If set, only roles containing that
- *   permission are returned.
+ * @param bool $membersonly
+ *   (optional) Set this to TRUE to exclude the 'anonymous' role. Defaults to
+ *   FALSE.
+ * @param string|null $permission
+ *   (optional) A string containing a permission. If set, only roles containing
+ *   that permission are returned. Defaults to NULL, which returns all roles.
  *
- * @return
+ * @return array
  *   An associative array with the role id as the key and the role name as
  *   value.
  */
@@ -1101,13 +1110,14 @@ function user_user_role_delete(RoleInterface $role) {
 /**
  * Retrieve an array of roles matching specified conditions.
  *
- * @param $membersonly
- *   Set this to TRUE to exclude the 'anonymous' role.
- * @param $permission
- *   A string containing a permission. If set, only roles containing that
- *   permission are returned.
+ * @param bool $membersonly
+ *   (optional) Set this to TRUE to exclude the 'anonymous' role. Defaults to
+ *   FALSE.
+ * @param string|null $permission
+ *   (optional) A string containing a permission. If set, only roles containing
+ *   that permission are returned. Defaults to NULL, which returns all roles.
  *
- * @return
+ * @return Drupal\user\RoleInterface[]
  *   An associative array with the role id as the key and the role object as
  *   value.
  */
@@ -1144,10 +1154,10 @@ function user_roles($membersonly = FALSE, $permission = NULL) {
 /**
  * Fetches a user role by role ID.
  *
- * @param $rid
+ * @param string $rid
  *   A string representing the role ID.
  *
- * @return
+ * @return \Drupal\user\RoleInterface|null
  *   A fully-loaded role object if a role with the given ID exists, or NULL
  *   otherwise.
  *
@@ -1166,13 +1176,13 @@ function user_role_load($rid) {
  * role, the form submit handler may directly pass the submitted values for the
  * checkboxes form element to this function.
  *
- * @param $rid
+ * @param mixed $rid
  *   The ID of a user role to alter.
- * @param $permissions
- *   An associative array, where the key holds the permission name and the value
- *   determines whether to grant or revoke that permission. Any value that
- *   evaluates to TRUE will cause the permission to be granted. Any value that
- *   evaluates to FALSE will cause the permission to be revoked.
+ * @param array $permissions
+ *   (optional) An associative array, where the key holds the permission name
+ *   and the value determines whether to grant or revoke that permission. Any
+ *   value that evaluates to TRUE will cause the permission to be granted. Any
+ *   value that evaluates to FALSE will cause the permission to be revoked.
  *   @code
  *     array(
  *       'administer nodes' => 0,                // Revoke 'administer nodes'
@@ -1203,10 +1213,10 @@ function user_role_change_permissions($rid, array $permissions = array()) {
 /**
  * Grant permissions to a user role.
  *
- * @param $rid
+ * @param mixed $rid
  *   The ID of a user role to alter.
- * @param $permissions
- *   A list of permission names to grant.
+ * @param array $permissions
+ *   (optional) A list of permission names to grant.
  *
  * @see user_role_change_permissions()
  * @see user_role_revoke_permissions()
@@ -1223,10 +1233,10 @@ function user_role_grant_permissions($rid, array $permissions = array()) {
 /**
  * Revoke permissions from a user role.
  *
- * @param $rid
+ * @param mixed $rid
  *   The ID of a user role to alter.
- * @param $permissions
- *   A list of permission names to revoke.
+ * @param array $permissions
+ *   (optional) A list of permission names to revoke.
  *
  * @see user_role_change_permissions()
  * @see user_role_grant_permissions()
@@ -1244,10 +1254,7 @@ function user_role_revoke_permissions($rid, array $permissions = array()) {
  * Conditionally create and send a notification email when a certain
  * operation happens on the given user account.
  *
- * @see user_mail_tokens()
- * @see \Drupal\Core\Mail\MailManagerInterface::mail()
- *
- * @param $op
+ * @param string $op
  *   The operation being performed on the account. Possible values:
  *   - 'register_admin_created': Welcome message for user created by the admin.
  *   - 'register_no_approval_required': Welcome message when user
@@ -1259,17 +1266,18 @@ function user_role_revoke_permissions($rid, array $permissions = array()) {
  *   - 'status_blocked': Account blocked.
  *   - 'cancel_confirm': Account cancellation request.
  *   - 'status_canceled': Account canceled.
- *
- * @param $account
+ * @param \Drupal\Core\Session\AccountInterface $account
  *   The user object of the account being notified. Must contain at
  *   least the fields 'uid', 'name', and 'mail'.
- * @param $langcode
- *   Optional language code to use for the notification, overriding account
+ * @param string $langcode
+ *   (optional) Language code to use for the notification, overriding account
  *   language.
  *
- * @return
- *   The return value from \Drupal::service('plugin.manager.mail')->mail(), if
- *   ends up being called.
+ * @return array
+ *   An array containint various information about the message.
+ *   See \Drupal\Core\Mail\MailManagerInterface::mail() for details.
+ *
+ * @see user_mail_tokens()
  */
 function _user_mail_notify($op, $account, $langcode = NULL) {
   // By default, we always notify except for canceled and blocked.
@@ -1381,7 +1389,7 @@ function user_modules_uninstalled($modules) {
 /**
  * Saves visitor information as a cookie so it can be reused.
  *
- * @param $values
+ * @param array $values
  *   An array of key/value pairs to be saved into a cookie.
  */
 function user_cookie_save(array $values) {
@@ -1394,7 +1402,7 @@ function user_cookie_save(array $values) {
 /**
  * Delete a visitor information cookie.
  *
- * @param $cookie_name
+ * @param string $cookie_name
  *   A cookie name such as 'homepage'.
  */
 function user_cookie_delete($cookie_name) {