Provide a tagged allocation top pointer.

src/x64/code-stubs-x64.cc

Index: src/x64/code-stubs-x64.cc
diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index ef254c9eb8105c307af2c07fe2680e2a5c71314f..3f980301936f5956a2d3305109101a6dca108425 100644
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -4308,6 +4308,7 @@ void FastNewObjectStub::Generate(MacroAssembler* masm) {
   __ movzxbl(rbx, FieldOperand(rcx, Map::kInstanceSizeOffset));
   __ leal(rbx, Operand(rbx, times_pointer_size, 0));
   __ Allocate(rbx, rax, rdi, no_reg, &allocate, NO_ALLOCATION_FLAGS);
+  __ decp(rdi);  // Untag result end.
   __ bind(&done_allocate);
 
   // Initialize the JSObject fields.
@@ -4456,6 +4457,7 @@ void FastNewRestParameterStub::Generate(MacroAssembler* masm) {
     // Allocate an empty rest parameter array.
     Label allocate, done_allocate;
     __ Allocate(JSArray::kSize, rax, rdx, rcx, &allocate, NO_ALLOCATION_FLAGS);
+    __ decp(rdx);  // Untag result end.
     __ bind(&done_allocate);
 
     // Setup the rest parameter array in rax.