Existing program analysis tools that implement abstraction rely on saturating procedures to compute over-approximations of
fixpoints. As an alternative, we propose a new algorithm to compute an over-approximation of the set of reachable states of
a program by replacing loops in the control flow graph by their abstract transformer. Our technique is able to generate diagnostic
information in case of property violations, which we call leaping counterexamples. We have implemented this technique and report experimental results on a set of large ANSI-C programs using abstract domains
that focus on properties related to string-buffers.
Supported by the Swiss National Science Foundation grant no. 200021-111687 and an award from IBM research.