[libfuzzer] Update documentation on UBSan options and Upload Corpus section.

testing/libfuzzer/getting_started.md

 # Getting Started with libFuzzer in Chrome
 
 *** note
 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. 
 ***
 
 This document will walk you through:
 
 * setting up your build enviroment.
 * creating your first fuzzer.
 * running the fuzzer and verifying its vitals.
 
 ## Configure Build
 
 Use `use_libfuzzer` GN argument together with sanitizer to generate build files:
 
 ```bash
 # With address sanitizer
 gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true enable_nacl=false' --check
 ```
 
 Supported sanitizer configurations are:
 
 | GN Argument | Description |
 |--------------|----|
 | is_asan=true | enables [Address Sanitizer] to catch problems like buffer overruns. |
 | is_msan=true | enables [Memory Sanitizer] to catch problems like uninitialed reads. |
-| is_ubsan_security=true | enables [Undefined Behavior Sanitizer] to catch undefined behavior like integer overflow. |
+| is_ubsan_security=true | enables [Undefined Behavior Sanitizer] to catch<sup>\[[1](#Notes)\]</sup> undefined behavior like integer overflow. |
 
 
 ## Write Fuzzer Function
 
 Create a new .cc file and define a `LLVMFuzzerTestOneInput` function:
 
 ```cpp
 extern "C" int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size) {
   // put your fuzzing code here and use data+size as input.
   return 0;
@@ skipping 55 matching lines @@
 The only thing you should do is to submit a fuzzer into Chrome.
 
 ## Next Steps
 
 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in
 a day or two.
 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer
 performance and for optimization hints.
 
 
+## Notes
+[1] By default UBSan doesn't crash once undefined behavior has been detected.
+To make it crash the following additional option should be provided:
+
+```bash
+UBSAN_OPTIONS=halt_on_error=1 ./fuzzer <corpus_directory_or_single_testcase_path>
+```
+
+Other useful options (used by ClusterFuzz) are:
+```bash
+UBSAN_OPTIONS=symbolize=1:halt_on_error=1:print_stacktrace=1 ./fuzzer <corpus_directory_or_single_testcase_path>

[aizatsky, 2016/04/19 18:42:43]

FYI: https://bugs.chromium.org/p/chromium/issues/detail?id=604823

[mmoroz, 2016/04/20 12:38:20]

Acknowledged.

+```
+
+
 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html
 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html
 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html
 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/src/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc
 [ClusterFuzz status]: clusterfuzz.md#Status-Links
 [Efficient Fuzzer Guide]: efficient_fuzzer.md
 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448