Fix bugs in simplified lowering relating to int32/uint32 signs.

test/unittests/compiler/js-typed-lowering-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 20 matching lines @@
 }  // namespace
 
 
 class JSTypedLoweringTest : public TypedGraphTest {
  public:
   JSTypedLoweringTest() : TypedGraphTest(3), javascript_(zone()) {}
   virtual ~JSTypedLoweringTest() {}
 
  protected:
   Reduction Reduce(Node* node) {
-    MachineOperatorBuilder machine;
+    MachineOperatorBuilder machine(zone());
     JSGraph jsgraph(graph(), common(), javascript(), &machine);
     JSTypedLowering reducer(&jsgraph);
     return reducer.Reduce(node);
   }
 
   Node* Parameter(Type* type, int index = 0) {
     Node* node = graph()->NewNode(common()->Parameter(index), graph()->start());
     NodeProperties::SetBounds(node, Bounds(Type::None(), type));
     return node;
   }
@@ skipping 131 matching lines @@
                       IsIntPtrConstant(bit_cast<intptr_t>(&backing_store[0])),
                       key, IsNumberConstant(array->length()->Number()), value,
                       effect, control));
     }
   }
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8