This pass runs after representation selection, since it needs to know which vregs can contain tagged pointers.