Fix bugs in simplified lowering relating to int32/uint32 signs.

test/unittests/compiler/js-builtin-reducer-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/compiler/typer.h"
 #include "test/unittests/compiler/graph-unittest.h"
 #include "test/unittests/compiler/node-test-utils.h"
 #include "testing/gmock-support.h"
 
 using testing::Capture;
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 class JSBuiltinReducerTest : public TypedGraphTest {
  public:
   JSBuiltinReducerTest() : javascript_(zone()) {}
 
  protected:
   Reduction Reduce(Node* node, MachineOperatorBuilder::Flags flags =
                                    MachineOperatorBuilder::Flag::kNoFlags) {
-    MachineOperatorBuilder machine(kMachPtr, flags);
+    MachineOperatorBuilder machine(zone(), kMachPtr, flags);
     JSGraph jsgraph(graph(), common(), javascript(), &machine);
     JSBuiltinReducer reducer(&jsgraph);
     return reducer.Reduce(node);
   }
 
   Node* Parameter(Type* t, int32_t index = 0) {
     Node* n = graph()->NewNode(common()->Parameter(index), graph()->start());
     NodeProperties::SetBounds(n, Bounds(Type::None(), t));
     return n;
   }
@@ skipping 259 matching lines @@
         graph()->NewNode(javascript()->CallFunction(3, NO_CALL_FUNCTION_FLAGS),
                          fun, UndefinedConstant(), p0);
     Reduction r = Reduce(call, MachineOperatorBuilder::Flag::kNoFlags);
 
     ASSERT_FALSE(r.Changed());
   }
 }
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8