[turbofan] Move SimplifiedOperatorBuilder into JSGraph.

[turbofan] Move SimplifiedOperatorBuilder into JSGraph.

This fixes the lifetime of nodes created by JSGlobalSpecialization that
contain a simplified operator. In the case where this reducer runs as
part of the inliner, the SimplifiedOperatorBuilder was instantiated with
the wrong zone. This led to use-after-free of simplified operators.

To avoid such situations in the future, we decided to move this operator
builder into the JSGraph and make the situation uniform with all other
operator builders.

R=bmeurer@chromium.org
BUG=chromium:543528
LOG=n

Committed: https://crrev.com/b7990793cf322a4de187a6d51caa3e14c749092e
Cr-Commit-Position: refs/heads/master@{#31334}

[Benedikt Meurer, 2015-10-16 11:44:56]

LGTM.

[Michael Starzinger, 2015-10-16 11:50:42]

The CQ bit was checked by mstarzinger@chromium.org

[commit-bot: I haz the power, 2015-10-16 11:50:55]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1409993002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1409993002/1

[commit-bot: I haz the power, 2015-10-16 12:38:49]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-10-16 12:39:01]

Patchset 1 (id:??) landed as
https://crrev.com/b7990793cf322a4de187a6d51caa3e14c749092e
Cr-Commit-Position: refs/heads/master@{#31334}