Provide a tagged allocation top pointer.

src/ia32/code-stubs-ia32.cc

Index: src/ia32/code-stubs-ia32.cc
diff --git a/src/ia32/code-stubs-ia32.cc b/src/ia32/code-stubs-ia32.cc
index 92e9afb585504c431b06e09ab10e402175943bd4..bb1314ecafbe223eccada2218d647ceace6c0736 100644
--- a/src/ia32/code-stubs-ia32.cc
+++ b/src/ia32/code-stubs-ia32.cc
@@ -4466,6 +4466,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   __ movzx_b(ebx, FieldOperand(ecx, Map::kInstanceSizeOffset));
   __ lea(ebx, Operand(ebx, times_pointer_size, 0));
   __ Allocate(ebx, eax, edi, no_reg, &allocate, NO_ALLOCATION_FLAGS);
+  __ dec(edi);  // Untag result end.
   __ bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4616,6 +4617,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, eax, edx, ecx, &allocate, NO_ALLOCATION_FLAGS);
+    __ dec(edx);  // Untag result end.
     __ bind(&done_allocate);
 
     // Setup the rest parameter array in rax.