From 6fc8b3570abfd6cdad6a95aee5ac947cfd1b30c0 Mon Sep 17 00:00:00 2001
From: Kasper Svendsen <kaspersv@github.com>
Date: Mon, 7 Sep 2026 14:52:48 +0200
Subject: [PATCH] Shared: Disable dynamic join ordering for select predicates

---
 shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll      | 2 ++
 .../dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll   | 3 +++
 shared/rangeanalysis/codeql/rangeanalysis/RangeAnalysis.qll    | 2 ++
 3 files changed, 7 insertions(+)

diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
index e467e6caa708..02ce4629a7bd 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
@@ -1490,6 +1490,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
         private module RevTypeFlow = TypeFlow<RevTypeFlowInput>;
 
+        pragma[no_dynamic_join_order]
         pragma[nomagic]
         private predicate flowIntoCallApValid(Call call, Callable c, ArgNd arg, ParamNd p, Ap ap) {
           flowIntoCallAp(call, c, arg, p, ap) and
@@ -1506,6 +1507,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
           )
         }
 
+        pragma[no_dynamic_join_order]
         private predicate revFlowIn(Call call, Callable c, ArgNd arg, Ap ap) {
           exists(ParamNd p |
             revFlow(p, TReturnCtxNone(), _, ap) and
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
index 8d77198e5721..72eebd158c1a 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
@@ -1004,6 +1004,7 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
 
     private predicate relevantType(Type t) { t = getNodeType(_) }
 
+    pragma[no_dynamic_join_order]
     cached
     predicate isTopType(Type t) {
       strictcount(Type t0 | relevantType(t0)) =
@@ -1513,6 +1514,7 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
           Cand::argumentValueFlowsThroughCand(arg, _, _)
         }
 
+        pragma[no_dynamic_join_order]
         pragma[nomagic]
         private predicate argumentValueFlowsThrough0(
           Call call, ArgNode arg, ReturnKind kind, ReadStepTypesOption read, string model,
@@ -2132,6 +2134,7 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
      * the current data flow stage has reached the call of `arg` from one of its
      * call targets.
      */
+    pragma[no_dynamic_join_order]
     private predicate typeFlowArgTypeFromReturn(ArgNode arg, Type t) {
       exists(ParamNode p, Type t1, Type t2 |
         dataFlowTakenCallEdgeOut(_, _, arg, p) and
diff --git a/shared/rangeanalysis/codeql/rangeanalysis/RangeAnalysis.qll b/shared/rangeanalysis/codeql/rangeanalysis/RangeAnalysis.qll
index ff17f9b5405a..83be840c4cfb 100644
--- a/shared/rangeanalysis/codeql/rangeanalysis/RangeAnalysis.qll
+++ b/shared/rangeanalysis/codeql/rangeanalysis/RangeAnalysis.qll
@@ -866,6 +866,7 @@ module RangeStage<
    * - `upper = true`  : `v <= b + delta`
    * - `upper = false` : `v >= b + delta`
    */
+  pragma[no_dynamic_join_order]
   private predicate boundedSsa(
     Sem::SsaVariable v, SemBound b, D::Delta delta, SsaReadPosition pos, boolean upper,
     boolean fromBackEdge, D::Delta origdelta, SemReason reason
@@ -1289,6 +1290,7 @@ module RangeStage<
    * - `upper = true`  : `e <= b + delta`
    * - `upper = false` : `e >= b + delta`
    */
+  pragma[no_dynamic_join_order]
   predicate initialBounded(
     Sem::Expr e, SemBound b, D::Delta delta, boolean upper, boolean fromBackEdge,
     D::Delta origdelta, SemReason reason