Rust: query evaluation ~15× slower on 2.26.4 vs 2.26.3 (4 min → 45–60 min, type-inference/data-flow stage)

**Description of the issue**

After the CodeQL bundle moved from **2.26.3 to 2.26.4**, Rust analysis of our workspace went from **~4 minutes to ~45–60 minutes** per run, with no change on our side. The extra time is almost entirely in query evaluation — the type-inference / data-flow stage — not extraction.

**Setup**

- GitHub code scanning *default setup* (so the bundle version is whatever the action ships; `codeql-action` v4.37.9 bumped the default bundle to 2.26.4 on 2026-08-26).
- `build-mode: none`, `ubuntu-latest` hosted runner (2 vCPU, `CODEQL_THREADS=2`, `CODEQL_RAM=6914`).
- Private Rust workspace: 15 crates, ~470k lines of Rust (roughly a third of that under `tests/`), ~720 packages in `Cargo.lock`, edition 2021. Standard async web-service stack — nothing exotic in the code.
- The default query suite (36 queries).

**What changed / what didn't**

We compared the last run on 2.26.3 and the first run on 2.26.4:

- Same `github/codeql-action` commit, same runner image.
- Same commit of our code (identical merge base; no diff at all in `Cargo.toml` / `Cargo.lock`).
- ~150 consecutive runs on 2.26.3 over the preceding four weeks: all 2–4 min. 50+ consecutive runs on 2.26.4 since: all 41–59 min. No overlap.

**Timings from the job logs**

| Stage | 2.26.3 | 2.26.4 |
|---|---|---|
| `total duration (Extract)` | 12.8 s | 59 s |
| `diagnostics/DataFlowConsistencyCounts` | 2m01s (slowest query) | ~30 min |
| `diagnostics/TypeInferenceConsistencyCounts` | 58 s | ~17 min |
| `diagnostics/SsaConsistencyCounts` | 50 s | ~13 min |
| `summary/NodesWithTypeAtLengthLimit` | < 1 s | ~22 min |
| `diagnostics/UnresolvedMacroCalls` | — | 6m11s |
| whole `security/*` data-flow batch (`CWE-089/SqlInjection`, `CWE-312/CleartextLogging`, `CWE-319/UseOfHttp`, `CWE-327/BrokenCryptoAlgorithm`, …) | well under a minute each | ~30 min each (shared batch) |

So extraction got ~5× slower but is still small; evaluation of everything downstream of type inference got roughly 15–30× slower.

**Suspected cause**

Looking at the Rust changes between `codeql-cli/v2.26.3` and `codeql-cli/v2.26.4`, the ones that touch the stage that regressed are:

- `52cbb679` "Rust: Evaluate `mayInvokeCallback` in type inference stage"
- `e9bd6988` "Rust: Assume callbacks will be invoked in library functions"
- the rust-analyzer upgrade to 0.0.328 (`ce360c4f`, `5f76c946`) and the derive-macro expansion restore (`1d6ac57d`).

The first two look like they widen the call graph feeding type inference, which is consistent with every data-flow query slowing down together. Happy to be corrected — that's inferred from the commit list, not from profiling.

One other difference we noticed in the extractor output on 2.26.4: a handful of new `macro expansion failed for '$crate::count'` warnings on the `metrics` crate's `counter!`-style macros that did not appear on 2.26.3. Possibly unrelated, mentioning it in case it points at the rust-analyzer upgrade.

**What would help**

- Is this a known regression in 2.26.4, and is there a tuning knob (e.g. an extractor option, or a way to cap the callback assumption) short of pinning the bundle?
- If profiling output from a run would help, tell me what to collect (`--evaluator-log` / `--tuple-counting` etc.) and I'll attach it.

We can pin `codeql-bundle-v2.26.3` via advanced setup in the meantime.

Compare CodeQL bundles 2.26.3 and 2.26.4 using the reported Rust workspace and review commits 52cbb679, e9bd6988, ce360c4f, 5f76c946, and 1d6ac57d. Collect the suggested evaluator-log or tuple-counting output if needed, then determine whether the callback, rust-analyzer, or macro changes explain the regression. Done means identifying the cause and a supported fix or tuning option.

由索引模型根据 Issue 内容生成。