Fix Range::Mul for fully non-positive ranges.

tests/language/vm/regress_22541_vm_test.dart

Index: tests/language/vm/regress_22541_vm_test.dart
diff --git a/tests/language/vm/regress_22541_vm_test.dart b/tests/language/vm/regress_22541_vm_test.dart
new file mode 100644
index 0000000000000000000000000000000000000000..21b8991e5499b1955c175edf8183e2bfb3fee9b5
--- /dev/null
+++ b/tests/language/vm/regress_22541_vm_test.dart
@@ -0,0 +1,22 @@
+// Copyright (c) 2015, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+// Test allocation sinking optimization.
+// VMOptions=--optimization-counter-threshold=10 --no-use-osr
+
+import 'package:expect/expect.dart';
+
+test(a) {
+  var x = a ? -1 : -2;
+  if (0 < (x * x)) {
+    return "ok";
+  } else {
+    return "fail";
+  }
+}
+
+main() {
+  for (var j = 0; j < 20; j++) {
+    Expect.equals("ok", test(false));
+  }
+}