Provide a tagged allocation top pointer.

src/x64/code-stubs-x64.cc

Index: src/x64/code-stubs-x64.cc
diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index c144797d73533eebec9b7280ceb35beefb530e93..db11e7ffed8ebf6d3e00515ec8c7ad4887414e16 100644
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -4204,6 +4204,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   __ movzxbl(rbx, FieldOperand(rcx, Map::kInstanceSizeOffset));
   __ leal(rbx, Operand(rbx, times_pointer_size, 0));
   __ Allocate(rbx, rax, rdi, no_reg, &allocate, NO_ALLOCATION_FLAGS);
+  __ decp(rdi);  // Untag result end.
   __ bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4352,6 +4353,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, rax, rdx, rcx, &allocate, NO_ALLOCATION_FLAGS);
+    __ decp(rdx);  // Untag result end.
     __ bind(&done_allocate);
 
     // Setup the rest parameter array in rax.