Add regression test for range analysis bug.

test/mjsunit/regress/regress-3204.js

Index: test/mjsunit/regress/regress-3204.js
diff --git a/test/mjsunit/regress/regress-3204.js b/test/mjsunit/regress/regress-3204.js
new file mode 100644
index 0000000000000000000000000000000000000000..dc754ff2d768b9eefb0f3493043b1cb32b82ed9e
--- /dev/null
+++ b/test/mjsunit/regress/regress-3204.js
@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function ModILeftCanBeNegative() {
+  var x = 0;
+  for (var i = -1; i < 0; ++i) x = i % 2;
+  return x;
+}
+
+ModILeftCanBeNegative();
+%OptimizeFunctionOnNextCall(ModILeftCanBeNegative);
+assertEquals(-1, ModILeftCanBeNegative());
+
+function ModIRightCanBeZero() {
+  var x = 0;
+  for (var i = -1; i <= 0; ++i) x = (2 % i) | 0;
+  return x;
+}
+
+ModIRightCanBeZero();
+%OptimizeFunctionOnNextCall(ModIRightCanBeZero);
+ModIRightCanBeZero();