| Index: src/arm/code-stubs-arm.cc
 | 
| diff --git a/src/arm/code-stubs-arm.cc b/src/arm/code-stubs-arm.cc
 | 
| index 8779921ac99d17c962c9365e22ad4cb0b22e71c4..0fe2b63a96bde4dc99f37cbd911defd24f7966ff 100644
 | 
| --- a/src/arm/code-stubs-arm.cc
 | 
| +++ b/src/arm/code-stubs-arm.cc
 | 
| @@ -4558,15 +4558,15 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
 | 
|    __ bind(&done_allocate);
 | 
|  
 | 
|    // Initialize the JSObject fields.
 | 
| -  __ str(r2, MemOperand(r0, JSObject::kMapOffset));
 | 
| +  __ str(r2, FieldMemOperand(r0, JSObject::kMapOffset));
 | 
|    __ LoadRoot(r3, Heap::kEmptyFixedArrayRootIndex);
 | 
| -  __ str(r3, MemOperand(r0, JSObject::kPropertiesOffset));
 | 
| -  __ str(r3, MemOperand(r0, JSObject::kElementsOffset));
 | 
| +  __ str(r3, FieldMemOperand(r0, JSObject::kPropertiesOffset));
 | 
| +  __ str(r3, FieldMemOperand(r0, JSObject::kElementsOffset));
 | 
|    STATIC_ASSERT(JSObject::kHeaderSize == 3 * kPointerSize);
 | 
| -  __ add(r1, r0, Operand(JSObject::kHeaderSize));
 | 
| +  __ add(r1, r0, Operand(JSObject::kHeaderSize - kHeapObjectTag));
 | 
|  
 | 
|    // ----------- S t a t e -------------
 | 
| -  //  -- r0 : result (untagged)
 | 
| +  //  -- r0 : result (tagged)
 | 
|    //  -- r1 : result fields (untagged)
 | 
|    //  -- r5 : result end (untagged)
 | 
|    //  -- r2 : initial map
 | 
| @@ -4584,10 +4584,6 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
 | 
|    {
 | 
|      // Initialize all in-object fields with undefined.
 | 
|      __ InitializeFieldsWithFiller(r1, r5, r6);
 | 
| -
 | 
| -    // Add the object tag to make the JSObject real.
 | 
| -    STATIC_ASSERT(kHeapObjectTag == 1);
 | 
| -    __ add(r0, r0, Operand(kHeapObjectTag));
 | 
|      __ Ret();
 | 
|    }
 | 
|    __ bind(&slack_tracking);
 | 
| @@ -4606,10 +4602,6 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
 | 
|      __ LoadRoot(r6, Heap::kOnePointerFillerMapRootIndex);
 | 
|      __ InitializeFieldsWithFiller(r1, r5, r6);
 | 
|  
 | 
| -    // Add the object tag to make the JSObject real.
 | 
| -    STATIC_ASSERT(kHeapObjectTag == 1);
 | 
| -    __ add(r0, r0, Operand(kHeapObjectTag));
 | 
| -
 | 
|      // Check if we can finalize the instance size.
 | 
|      STATIC_ASSERT(Map::kSlackTrackingCounterEnd == 1);
 | 
|      __ tst(r3, Operand(Map::ConstructionCounter::kMask));
 | 
| @@ -4636,10 +4628,10 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
 | 
|      __ CallRuntime(Runtime::kAllocateInNewSpace);
 | 
|      __ Pop(r2);
 | 
|    }
 | 
| -  STATIC_ASSERT(kHeapObjectTag == 1);
 | 
| -  __ sub(r0, r0, Operand(kHeapObjectTag));
 | 
|    __ ldrb(r5, FieldMemOperand(r2, Map::kInstanceSizeOffset));
 | 
|    __ add(r5, r0, Operand(r5, LSL, kPointerSizeLog2));
 | 
| +  STATIC_ASSERT(kHeapObjectTag == 1);
 | 
| +  __ sub(r5, r5, Operand(kHeapObjectTag));
 | 
|    __ b(&done_allocate);
 | 
|  
 | 
|    // Fall back to %NewObject.
 | 
| @@ -4702,7 +4694,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
 | 
|  
 | 
|      // Allocate an empty rest parameter array.
 | 
|      Label allocate, done_allocate;
 | 
| -    __ Allocate(JSArray::kSize, r0, r1, r2, &allocate, TAG_OBJECT);
 | 
| +    __ Allocate(JSArray::kSize, r0, r1, r2, &allocate, NO_ALLOCATION_FLAGS);
 | 
|      __ bind(&done_allocate);
 | 
|  
 | 
|      // Setup the rest parameter array in r0.
 | 
| @@ -4744,7 +4736,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
 | 
|      Label allocate, done_allocate;
 | 
|      __ mov(r1, Operand(JSArray::kSize + FixedArray::kHeaderSize));
 | 
|      __ add(r1, r1, Operand(r0, LSL, kPointerSizeLog2 - 1));
 | 
| -    __ Allocate(r1, r3, r4, r5, &allocate, TAG_OBJECT);
 | 
| +    __ Allocate(r1, r3, r4, r5, &allocate, NO_ALLOCATION_FLAGS);
 | 
|      __ bind(&done_allocate);
 | 
|  
 | 
|      // Setup the elements array in r3.
 | 
| @@ -4876,7 +4868,7 @@ void FastNewSloppyArgumentsStub::Generate(MacroAssembler* masm) {
 | 
|    __ add(r9, r9, Operand(JSSloppyArgumentsObject::kSize));
 | 
|  
 | 
|    // Do the allocation of all three objects in one go.
 | 
| -  __ Allocate(r9, r0, r9, r4, &runtime, TAG_OBJECT);
 | 
| +  __ Allocate(r9, r0, r9, r4, &runtime, NO_ALLOCATION_FLAGS);
 | 
|  
 | 
|    // r0 = address of new object(s) (tagged)
 | 
|    // r2 = argument count (smi-tagged)
 | 
| @@ -5073,7 +5065,7 @@ void FastNewStrictArgumentsStub::Generate(MacroAssembler* masm) {
 | 
|    Label allocate, done_allocate;
 | 
|    __ mov(r1, Operand(JSStrictArgumentsObject::kSize + FixedArray::kHeaderSize));
 | 
|    __ add(r1, r1, Operand(r0, LSL, kPointerSizeLog2 - 1));
 | 
| -  __ Allocate(r1, r3, r4, r5, &allocate, TAG_OBJECT);
 | 
| +  __ Allocate(r1, r3, r4, r5, &allocate, NO_ALLOCATION_FLAGS);
 | 
|    __ bind(&done_allocate);
 | 
|  
 | 
|    // Setup the elements array in r3.
 | 
| 
 |