Yet another regression test for range analysis.

BUG=v8:3204
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/224723016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

test/mjsunit/regress/regress-3204.js

@@ -4,6 +4,21 @@
 
 // Flags: --allow-natives-syntax
 
+// -----------------------------------------------------------------------------
+
+function SmiTaggingCanOverflow(x) {
+ x = x | 0;
+ if (x == 0) return;
+ return x;
+}
+
+SmiTaggingCanOverflow(2147483647);
+SmiTaggingCanOverflow(2147483647);
+%OptimizeFunctionOnNextCall(SmiTaggingCanOverflow);
+assertEquals(2147483647, SmiTaggingCanOverflow(2147483647));
+
+// -----------------------------------------------------------------------------
+
 function ModILeftCanBeNegative() {
   var x = 0;
   for (var i = -1; i < 0; ++i) x = i % 2;
@@ -14,6 +29,8 @@ ModILeftCanBeNegative();
 %OptimizeFunctionOnNextCall(ModILeftCanBeNegative);
 assertEquals(-1, ModILeftCanBeNegative());
 
+// -----------------------------------------------------------------------------
+
 function ModIRightCanBeZero() {
   var x = 0;
   for (var i = -1; i <= 0; ++i) x = (2 % i) | 0;