fast-math: Fold float multiplication by minus one to unary negative

[MaxGraey]

After #3155 we could add more NaN-sign sensitive simplifications for float operations.
x * -1.0 -> -x (fneg(x))

[MaxGraey]

Also removed fastMath guard from here to allow canonicalize x - (-0.0) ==> x + 0.0 which is always safe

[tlively]

@kripken what was the verdict here? I thought we had decided this wasn't safe.

[kripken]

I think this is safe as we do still have an operation - we just replace an add with a subtract, and they should have the same impact on NaN bits. Also, I don't think making the constant negative makes a difference. So this looks ok to me.

I'd recommend verifying this with another data point, like running the wasm before and after this opt in V8, and seeing that indeed all is as expected. That would prevent the fuzzer from finding a problem later - and since it can detect this, if it can't find a problem, I think we're ok.

[MaxGraey]

Fuzzed:

Invocations so far:
   FuzzExec: 14258
   CompareVMs: 3885
   CheckDeterminism: 1198
   Wasm2JS: 3382
   Asyncify: 3651

ITERATION: 16749

[tlively]

The transformation itself looks good, but I'm not so sure about the other changes.

[tlively]

@kripken what was the verdict here? I thought we had decided this wasn't safe.

[tlively]

@MaxGraey, ping me once you've double checked the safety of x - (-0.0) ==> x + 0.0 on V8 as @kripken suggested and we can merge this 👍

[MaxGraey]

This is WebAssembly fiddle which compare different variant of subtractions NaN (quiet, signal, arithm, non-canonical, signed and unsigned) and negative zero with similar but optimized version: https://webassembly.studio/?f=fs4kfeplvgb

On Chrome 85. All transforms valid.
On Firefox 81. All transforms valid as well.