Provide a tagged allocation top pointer.

src/arm/code-stubs-arm.cc

Index: src/arm/code-stubs-arm.cc
diff --git a/src/arm/code-stubs-arm.cc b/src/arm/code-stubs-arm.cc
index bf4d4a52a9f9cba70f19f52001fbb7a93a6d1095..cde592d226090cd956d827c6fdab9b2160a52ce9 100644
--- a/src/arm/code-stubs-arm.cc
+++ b/src/arm/code-stubs-arm.cc
@@ -4333,6 +4333,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   Label allocate, done_allocate;
   __ ldrb(r4, FieldMemOperand(r2, Map::kInstanceSizeOffset));
   __ Allocate(r4, r0, r5, r6, &allocate, SIZE_IN_WORDS);
+  __ sub(r5, r5, Operand(kHeapObjectTag));  // Untag result end.
   __ bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4473,6 +4474,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, r0, r1, r2, &allocate, NO_ALLOCATION_FLAGS);
+    __ sub(r1, r1, Operand(kHeapObjectTag));  // Untag result end.
     __ bind(&done_allocate);
 
     // Setup the rest parameter array in r0.