Provide a tagged allocation top pointer.

src/mips/code-stubs-mips.cc

Index: src/mips/code-stubs-mips.cc
diff --git a/src/mips/code-stubs-mips.cc b/src/mips/code-stubs-mips.cc
index e24f805caff2e4b74d3dadb091e5ce941d37341f..30eddf2f77002d5aebb7a0914cfa981c39e71e5e 100644
--- a/src/mips/code-stubs-mips.cc
+++ b/src/mips/code-stubs-mips.cc
@@ -4514,6 +4514,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   Label allocate, done_allocate;
   __ lbu(t0, FieldMemOperand(a2, Map::kInstanceSizeOffset));
   __ Allocate(t0, v0, t1, a0, &allocate, SIZE_IN_WORDS);
+  __ Subu(t1, t1, Operand(kHeapObjectTag));  // Untag result end.
   __ bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4657,6 +4658,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, v0, a0, a1, &allocate, NO_ALLOCATION_FLAGS);
+    __ Subu(a0, a0, Operand(kHeapObjectTag));  // Untag result end.
     __ bind(&done_allocate);
 
     // Setup the rest parameter array in v0.