Provide tagged allocation top pointer

src/x64/code-stubs-x64.cc

Index: src/x64/code-stubs-x64.cc
diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index 602d3a01a926e18ea923affd85d4d832fcb9f148..c6ba542c93b87ac0ccccaeedb6bf87405f5f8cfa 100644
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -4316,6 +4316,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   __ movzxbl(rbx, FieldOperand(rcx, Map::kInstanceSizeOffset));
   __ leal(rbx, Operand(rbx, times_pointer_size, 0));
   __ Allocate(rbx, rax, rdi, no_reg, &allocate, NO_ALLOCATION_FLAGS);
+  __ decp(rdi);  // Untag result end.
   __ bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4464,6 +4465,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, rax, rdx, rcx, &allocate, NO_ALLOCATION_FLAGS);
+    __ decp(rdx);  // Untag result end.
     __ bind(&done_allocate);
 
     // Setup the rest parameter array in rax.