PAP invariant of pointer tagging does not hold in profiling builds
The PAP invariant of pointer tagging says
the PAP entry code jumps to the function's entry code, so it must have a tagged pointer to the function closure in R1. We therefore assume that a PAP always contains a tagged pointer to the function closure.
As discovered while debugging #15508 (closed), this currently does not hold. I tried to fix this in one PAP allocation site in D5051 but it somehow broke another test. We should review all PAP allocation sites and make sure the invariant holds, and then fix any bugs that this fix reveals.