Oh nice, this is new to me. Herbgrind does dynamic analysis, but doesn't this mean it doesn't know which values are to be treated as variables? Once I hooked H

Oh nice, this is new to me. Herbgrind does dynamic analysis, but doesn't this mean it doesn't know which values are to be treated as variables? Once I hooked Herbie up to the Clang Static Analyzer to pull out expressions from code and suggest alternatives. It wasn't a great fit---CSA doesn't model floating point, and it would consider every sub-expression separately as it explored the program. But I think there's merit to the idea.