Provide a tagged allocation top pointer.

src/ia32/code-stubs-ia32.cc

Index: src/ia32/code-stubs-ia32.cc
diff --git a/src/ia32/code-stubs-ia32.cc b/src/ia32/code-stubs-ia32.cc
index 431e56290a03370a2d066d2a1f53bb131edeeff6..b2d8d24a6b2f2f3d40dd183b8843de50757f20d0 100644
--- a/src/ia32/code-stubs-ia32.cc
+++ b/src/ia32/code-stubs-ia32.cc
@@ -4572,6 +4572,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   __ movzx_b(ebx, FieldOperand(ecx, Map::kInstanceSizeOffset));
   __ lea(ebx, Operand(ebx, times_pointer_size, 0));
   __ Allocate(ebx, eax, edi, no_reg, &allocate, NO_ALLOCATION_FLAGS);
+  __ dec(edi);  // Untag result end.
   __ bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4722,6 +4723,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, eax, edx, ecx, &allocate, NO_ALLOCATION_FLAGS);
+    __ dec(edx);  // Untag result end.
     __ bind(&done_allocate);
 
     // Setup the rest parameter array in rax.