Rust: query evaluation ~15× slower on 2.26.4 vs 2.26.3 (4 min → 45–60 min, type-inference/data-flow stage)

So sánh các bundle CodeQL 2.26.3 và 2.26.4 bằng Rust workspace đã được báo cáo, đồng thời xem xét các commit 52cbb679, e9bd6988, ce360c4f, 5f76c946 và 1d6ac57d. Thu thập output evaluator-log hoặc tuple-counting được đề xuất nếu cần, sau đó xác định liệu các thay đổi về callback, rust-analyzer hoặc macro có giải thích được regression hay không. Hoàn tất khi xác định được nguyên nhân và một fix được hỗ trợ hoặc một tùy chọn tuning.

Description of the issue

After the CodeQL bundle moved from 2.26.3 to 2.26.4, Rust analysis of our workspace went from ~4 minutes to ~45–60 minutes per run, with no change on our side. The extra time is almost entirely in query evaluation — the type-inference / data-flow stage — not extraction.

Setup

• GitHub code scanning default setup (so the bundle version is whatever the action ships; codeql-action v4.37.9 bumped the default bundle to 2.26.4 on 2026-08-26).
• build-mode: none, ubuntu-latest hosted runner (2 vCPU, CODEQL_THREADS=2, CODEQL_RAM=6914).
• Private Rust workspace: 15 crates, ~470k lines of Rust (roughly a third of that under tests/), ~720 packages in Cargo.lock, edition 2021. Standard async web-service stack — nothing exotic in the code.
• The default query suite (36 queries).

What changed / what didn't

We compared the last run on 2.26.3 and the first run on 2.26.4:

• Same github/codeql-action commit, same runner image.
• Same commit of our code (identical merge base; no diff at all in Cargo.toml / Cargo.lock).
• ~150 consecutive runs on 2.26.3 over the preceding four weeks: all 2–4 min. 50+ consecutive runs on 2.26.4 since: all 41–59 min. No overlap.

Timings from the job logs

So extraction got ~5× slower but is still small; evaluation of everything downstream of type inference got roughly 15–30× slower.

Suspected cause

Looking at the Rust changes between codeql-cli/v2.26.3 and codeql-cli/v2.26.4, the ones that touch the stage that regressed are:

• 52cbb679 "Rust: Evaluate mayInvokeCallback in type inference stage"
• e9bd6988 "Rust: Assume callbacks will be invoked in library functions"
• the rust-analyzer upgrade to 0.0.328 (ce360c4f, 5f76c946) and the derive-macro expansion restore (1d6ac57d).

The first two look like they widen the call graph feeding type inference, which is consistent with every data-flow query slowing down together. Happy to be corrected — that's inferred from the commit list, not from profiling.

One other difference we noticed in the extractor output on 2.26.4: a handful of new macro expansion failed for '$crate::count' warnings on the metrics crate's counter!-style macros that did not appear on 2.26.3. Possibly unrelated, mentioning it in case it points at the rust-analyzer upgrade.

What would help

• Is this a known regression in 2.26.4, and is there a tuning knob (e.g. an extractor option, or a way to cap the callback assumption) short of pinning the bundle?
• If profiling output from a run would help, tell me what to collect (--evaluator-log / --tuple-counting etc.) and I'll attach it.

We can pin codeql-bundle-v2.26.3 via advanced setup in the meantime.