Below is a simple C++ file illustrating two uses of codeql Initializer .

#include <iostream>
#include <cstdlib>

using namespace std;
int main()
{
    char* test1 = "hello world";
    if(char* test2 = (char*)malloc(10))
    {
        cout<<"test"<<endl;
    }
}

This example illustrates a few inconsistencies in how Initializer logic functions.

The first issue is that the initializer expression does not appear to be a child of the if condition expression. The following query will yield no result.

/**
 * @kind problem
 */
import cpp

from Initializer i, IfStmt ifs
where ifs.getControllingExpr().getAChild*() = i.getExpr()
select i, "TEST"

The second issue, which is more minor and potentially not an issue is the query below will find that test2 is an access of itself, whereas test1 is not an access. This may be expected however, since test2 is first assigned, then result evaluated by the if conditional. I'm not entirely sure if that's what is going on here though.

/**
 * @kind problem
 */
import cpp

from Variable v, Expr e
where 
e = v.getAnAccess()
select e, "TEST"