See TranslatedElement.qll. We currently handle the cases where the initializer is either a ClassAggregateLiteral or a ConstructorFieldInit which has an explicit initializer expression. Not covered is the case where there is no initializer expression, but where field being initialized does have have an initializer.

We could add something along the lines of:

    exists(ConstructorFieldInit init |
       not ignoreExpr(init) and
       ast = init and
       field = init.getTarget() and
       not exists(init.getExpr()) and
       expr = field.getInitializer().getExpr().getFullyConverted()
     )

However, this by itself is not sufficient, as the expression field.getInitializer().getExpr() does not have an enclosing function, while one is assumed to exist in the translation.

Note that the extractor does not generate a value for init.getExpr() in this case, to avoid ending up in a situation where an expression has multiple parents.

Thanks for the investigation. This is indeed not a trivial fix.

Ideas for whoever does attempt to tackle this:

1. Generate a separate set of IR instructions/operands for the field initializer expression in each constructor in which it is implicitly used. Pro: probably the simplest solution. Con: Breaks the existing invariant that each AST expression has a single IR instruction that produces its result.
2. Have the extractor generate a copy of the initializer expression to use as the actual field initializer in each constructor that needs it. The IR construction would then treat this like any other initializer. Pro: Preserves existing invariants. Con: Requires extractor change.