Fix buggy computations in value ranges, spotted by floitsch@.

lib/compiler/implementation/ssa/value_range_analyzer.dart

Index: lib/compiler/implementation/ssa/value_range_analyzer.dart
===================================================================
--- lib/compiler/implementation/ssa/value_range_analyzer.dart	(revision 13086)
+++ lib/compiler/implementation/ssa/value_range_analyzer.dart	(working copy)
@@ -286,11 +286,20 @@
   }
 
   Range operator -(Range other) {
-    return new Range.normalize(lower - other.lower, upper - other.upper);
+    return new Range.normalize(lower - other.upper, upper - other.lower);
   }
 
   Range operator &(Range other) {
-    return new Range.normalize(lower & other.lower, upper & other.upper);
+    // Only operate on simple operations, ie when one of the range is

[floitsch, 2012/10/02 09:32:28]

There is no need to make this restriction.
if this.isPositive && other.isPositive: [0 .. max(upper, other.upper)];
if (this.isPositive): [0 .. upper]
if (other.isPositive): [0 .. other.upper]
You could also get better ranges when the ranges are negative, but I'm not sure
it's worth it. For example:
if this.isNegative && other.isNegative: [-infinity, max(upper, other.upper)].
And there is probably a way to make the -infinity go away.

+    // constant.
+    if (lower == upper) {
+      if (isPositive()) return new Range(const IntValue(0), upper);
+      else if (isNegative()) return new Range(lower, const IntValue(0));

[floitsch, 2012/10/02 09:32:28]

This is wrong: -1 & 5 -> 5

+      else return const Range.unbound();
+    } else if (other.lower == other.upper) {
+      return other & this;
+    }
+    return const Range.unbound();
   }
 
   bool operator ==(other) {