one wonders what the difference between "delete" and "modify" is...

modify = delete + inject?

happy to see that someone else saw that! I mostly wrote that post / code as a tutorial on how to write checkers in a symbolic infrastructure, I think it was a little successful. I've been working on making checkers like that better, but that work is depressing because people like the author of AFL spend a lot of time telling me (indirectly) that it will never work, never scale, and never matter.

I read it and thought it was super cool.

I was inspired to write my own checker to demonstrate how easy it was to my software team.

And when I get a chance I'll try to contribute some general-purpose checkers to clang.

I dunno if it will work, but IMO it matters. If for no other reason than inspiring other folks!

Yay :)

How does your checker work?

the parent comment has a link that includes code and a blog post. clang-analyzer uses "symbolic execution". the work I've been doing in extension also uses symbolic execution.