Comment by awruef

the parent comment has a link that includes code and a blog post. clang-analyzer uses "symbolic execution". the work I've been doing in extension also uses symbolic execution.