Rust: query evaluation ~15× slower on 2.26.4 vs 2.26.3 (4 min → 45–60 min, type-inference/data-flow stage)

**Description of the issue**

After the CodeQL bundle moved from **2.26.3 to 2.26.4**, Rust analysis of our workspace went from **~4 minutes to ~45–60 minutes** per run, with no change on our side. The extra time is almost entirely in query evaluation — the type-inference / data-flow stage — not extraction.

**Setup**

- GitHub code scanning *default setup* (so the bundle version is whatever the action ships; `codeql-action` v4.37.9 bumped the default bundle to 2.26.4 on 2026-08-26).
- `build-mode: none`, `ubuntu-latest` hosted runner (2 vCPU, `CODEQL_THREADS=2`, `CODEQL_RAM=6914`).
- Private Rust workspace: 15 crates, ~470k lines of Rust (roughly a third of that under `tests/`), ~720 packages in `Cargo.lock`, edition 2021. Standard async web-service stack — nothing exotic in the code.
- The default query suite (36 queries).

**What changed / what didn't**

We compared the last run on 2.26.3 and the first run on 2.26.4:

- Same `github/codeql-action` commit, same runner image.
- Same commit of our code (identical merge base; no diff at all in `Cargo.toml` / `Cargo.lock`).
- ~150 consecutive runs on 2.26.3 over the preceding four weeks: all 2–4 min. 50+ consecutive runs on 2.26.4 since: all 41–59 min. No overlap.

**Timings from the job logs**

| Stage | 2.26.3 | 2.26.4 |
|---|---|---|
| `total duration (Extract)` | 12.8 s | 59 s |
| `diagnostics/DataFlowConsistencyCounts` | 2m01s (slowest query) | ~30 min |
| `diagnostics/TypeInferenceConsistencyCounts` | 58 s | ~17 min |
| `diagnostics/SsaConsistencyCounts` | 50 s | ~13 min |
| `summary/NodesWithTypeAtLengthLimit` | < 1 s | ~22 min |
| `diagnostics/UnresolvedMacroCalls` | — | 6m11s |
| whole `security/*` data-flow batch (`CWE-089/SqlInjection`, `CWE-312/CleartextLogging`, `CWE-319/UseOfHttp`, `CWE-327/BrokenCryptoAlgorithm`, …) | well under a minute each | ~30 min each (shared batch) |

So extraction got ~5× slower but is still small; evaluation of everything downstream of type inference got roughly 15–30× slower.

**Suspected cause**

Looking at the Rust changes between `codeql-cli/v2.26.3` and `codeql-cli/v2.26.4`, the ones that touch the stage that regressed are:

- `52cbb679` "Rust: Evaluate `mayInvokeCallback` in type inference stage"
- `e9bd6988` "Rust: Assume callbacks will be invoked in library functions"
- the rust-analyzer upgrade to 0.0.328 (`ce360c4f`, `5f76c946`) and the derive-macro expansion restore (`1d6ac57d`).

The first two look like they widen the call graph feeding type inference, which is consistent with every data-flow query slowing down together. Happy to be corrected — that's inferred from the commit list, not from profiling.

One other difference we noticed in the extractor output on 2.26.4: a handful of new `macro expansion failed for '$crate::count'` warnings on the `metrics` crate's `counter!`-style macros that did not appear on 2.26.3. Possibly unrelated, mentioning it in case it points at the rust-analyzer upgrade.

**What would help**

- Is this a known regression in 2.26.4, and is there a tuning knob (e.g. an extractor option, or a way to cap the callback assumption) short of pinning the bundle?
- If profiling output from a run would help, tell me what to collect (`--evaluator-log` / `--tuple-counting` etc.) and I'll attach it.

We can pin `codeql-bundle-v2.26.3` via advanced setup in the meantime.

So sánh các bundle CodeQL 2.26.3 và 2.26.4 bằng Rust workspace đã được báo cáo, đồng thời xem xét các commit 52cbb679, e9bd6988, ce360c4f, 5f76c946 và 1d6ac57d. Thu thập output evaluator-log hoặc tuple-counting được đề xuất nếu cần, sau đó xác định liệu các thay đổi về callback, rust-analyzer hoặc macro có giải thích được regression hay không. Hoàn tất khi xác định được nguyên nhân và một fix được hỗ trợ hoặc một tùy chọn tuning.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.