Provide a tagged allocation top pointer.

src/arm64/code-stubs-arm64.cc

Index: src/arm64/code-stubs-arm64.cc
diff --git a/src/arm64/code-stubs-arm64.cc b/src/arm64/code-stubs-arm64.cc
index cf4cd72e663021e50ce1a9e4b63eb7307adfce2b..240e494260484f514d2869578c1497b61c9ae9d6 100644
--- a/src/arm64/code-stubs-arm64.cc
+++ b/src/arm64/code-stubs-arm64.cc
@@ -4592,6 +4592,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   Label allocate, done_allocate;
   __ Ldrb(x4, FieldMemOperand(x2, Map::kInstanceSizeOffset));
   __ Allocate(x4, x0, x5, x6, &allocate, SIZE_IN_WORDS);
+  __ Sub(x5, x5, Operand(kHeapObjectTag));  // Untag result end.
   __ Bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4739,6 +4740,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, x0, x1, x2, &allocate, NO_ALLOCATION_FLAGS);
+    __ Sub(x1, x1, Operand(kHeapObjectTag));  // Untag result end.
     __ Bind(&done_allocate);
 
     // Setup the rest parameter array in x0.