[dart2js] Handle MarkerValue in NegateValue binary operations.

The MarkerValue class was added fairly recently: https://github.com/dart-lang/sdk/commit/404edd94351b46290f533a7f7ecdc744164ba2ac

Fixed: https://github.com/dart-lang/sdk/issues/54453
Change-Id: Ia0e306d9b42ebba5beae461d8edfcd45f19e1c64
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/343800
Commit-Queue: Nate Biggs <natebiggs@google.com>
Reviewed-by: Stephen Adams <sra@google.com>
diff --git a/pkg/compiler/lib/src/ssa/value_range_analyzer.dart b/pkg/compiler/lib/src/ssa/value_range_analyzer.dart
index 1e29284..635fe64 100644
--- a/pkg/compiler/lib/src/ssa/value_range_analyzer.dart
+++ b/pkg/compiler/lib/src/ssa/value_range_analyzer.dart
@@ -530,7 +530,7 @@
       }
       return info.newSubtractValue(other, value);
     }
-    if (other is InstructionValue) {
+    if (other is VariableValue) {
       return info.newSubtractValue(other, value);
     }
     return other - value;
@@ -548,7 +548,7 @@
       }
       return info.newSubtractValue(this, other);
     }
-    if (other is InstructionValue) {
+    if (other is VariableValue) {
       return info.newSubtractValue(this, other);
     }
     if (other is NegateValue) return this + other.value;
diff --git a/tests/web/regress/issue/54453_test.dart b/tests/web/regress/issue/54453_test.dart
new file mode 100644
index 0000000..984e273
--- /dev/null
+++ b/tests/web/regress/issue/54453_test.dart
@@ -0,0 +1,13 @@
+// Copyright (c) 2023, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// Make sure binary operations are correctly handled for range-like values in
+// SSA's value range analyzer.
+
+void main() {
+  int counter = 0;
+  for (int i = 0; i < 5; i++) {
+    counter += counter;
+  }
+}