Add regression test for range analysis bug.

BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/200103002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

test/mjsunit/regress/regress-3204.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function ModILeftCanBeNegative() {
+  var x = 0;
+  for (var i = -1; i < 0; ++i) x = i % 2;
+  return x;
+}
+
+ModILeftCanBeNegative();
+%OptimizeFunctionOnNextCall(ModILeftCanBeNegative);
+assertEquals(-1, ModILeftCanBeNegative());
+
+function ModIRightCanBeZero() {
+  var x = 0;
+  for (var i = -1; i <= 0; ++i) x = (2 % i) | 0;
+  return x;
+}
+
+ModIRightCanBeZero();
+%OptimizeFunctionOnNextCall(ModIRightCanBeZero);
+ModIRightCanBeZero();