Provide a tagged allocation top pointer.

src/mips/code-stubs-mips.cc

Index: src/mips/code-stubs-mips.cc
diff --git a/src/mips/code-stubs-mips.cc b/src/mips/code-stubs-mips.cc
index 726c077d678905d4c73946c339dcb7fb6334bf5e..01bc06c3e0fe4cec02ca8d27cfef45ace063772a 100644
--- a/src/mips/code-stubs-mips.cc
+++ b/src/mips/code-stubs-mips.cc
@@ -4610,6 +4610,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   Label allocate, done_allocate;
   __ lbu(t0, FieldMemOperand(a2, Map::kInstanceSizeOffset));
   __ Allocate(t0, v0, t1, a0, &allocate, SIZE_IN_WORDS);
+  __ Subu(t1, t1, Operand(kHeapObjectTag));  // Untag result end.
   __ bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4753,6 +4754,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, v0, a0, a1, &allocate, NO_ALLOCATION_FLAGS);
+    __ Subu(a0, a0, Operand(kHeapObjectTag));  // Untag result end.
     __ bind(&done_allocate);
 
     // Setup the rest parameter array in v0.