Variables are a Curse in Software Vulnerability Prediction