Re-enable UBsan on AGC.

webrtc/modules/audio_processing/agc/legacy/digital_agc.c

 /*
  *  Copyright (c) 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 169 matching lines @@
       }
       logApprox = 0;
       if (tmpU32no2 < tmpU32no1) {
         logApprox = (tmpU32no1 - tmpU32no2) >> (8 - zerosScale);  // Q14
       }
     }
     numFIX = (maxGain * constMaxGain) * (1 << 6);  // Q14
     numFIX -= (int32_t)logApprox * diffGain;       // Q14
 
     // Calculate ratio
-    // Shift |numFIX| as much as possible.
-    // Ensure we avoid wrap-around in |den| as well.
-    if (numFIX > (den >> 8))  // |den| is Q8.

[minyue-webrtc, 2016/05/21 12:33:37]

Two problems were with this part

1. if |numFIX| is negative, it will take 196 and the shift can be too large

2. line 203/205 may overflow.

See my solution.

-    {
-      zeros = WebRtcSpl_NormW32(numFIX);
-    } else {
-      zeros = WebRtcSpl_NormW32(den) + 8;
-    }
+    // 1) Shift |numFIX| as much as possible. Since we later add |den| / 2 to
+    // |numFIX| before dividing |den| to round the ratio, we use |numFIX| *2 to
+    // calculate the bit for shifting.
+    // 2) Ensure we avoid wrap-around in |den| as well.
+    zeros = WEBRTC_SPL_MIN(WebRtcSpl_NormW32(numFIX * 2),

[peah-webrtc, 2016/05/23 04:59:37]

The norm computation is on some platforms fairly complex. It probably does not
matter that much, but it is likely faster to do instead do:
int64_t tmp64 = numFIX * 256;  // Q8.
if (tmp64 > den)  // |den| is Q8. 
{
 zeros = WebRtcSpl_NormW32(numFIX);
} else {
 zeros = WebRtcSpl_NormW32(den) + 8;
}

[peah-webrtc, 2016/05/23 04:59:37]

How do you know that numFIX * 2 does not overflow? Normalizing as
WebRtcSpl_NormW32(numFIX) which was done before seems safer.

Alternatively, if you want the norm to be one less than before, it is better to
compute zeros as
WebRtcSpl_NormW32(numFIX) - 1

[minyue-webrtc, 2016/05/23 07:40:48]

Good question, after a second thought, I see that |den| being too large can also
overflow. A better way is to deal with rounding in another way. See my new
patch.

On 2016/05/23 04:59:37, peah-webrtc wrote:

+                           WebRtcSpl_NormW32(den) + 8);
     numFIX *= 1 << zeros;  // Q(14+zeros)
 
     // Shift den so we end up in Qy1
     tmp32no1 = WEBRTC_SPL_SHIFT_W32(den, zeros - 8);  // Q(zeros)
     if (numFIX < 0) {
       numFIX -= tmp32no1 / 2;

[peah-webrtc, 2016/05/23 04:59:36]

Does changing WebRtcSpl_NormW32(numFIX) to WebRtcSpl_NormW32(numFIX * 2) solve
the overflow on these on 201+203?

     } else {
       numFIX += tmp32no1 / 2;
     }
     y32 = numFIX / tmp32no1;  // in Q14
     if (limiterEnable && (i < limiterIdx)) {
       tmp32 = WEBRTC_SPL_MUL_16_U16(i - 1, kLog10_2);  // Q14
       tmp32 -= limiterLvl * (1 << 14);                 // Q14
       y32 = WebRtcSpl_DivW32W16(tmp32 + 10, 20);
     }
     if (y32 > 39000) {
@@ skipping 467 matching lines @@
   // limit
   if (state->logRatio > 2048) {
     state->logRatio = 2048;
   }
   if (state->logRatio < -2048) {
     state->logRatio = -2048;
   }
 
   return state->logRatio;  // Q10
 }