From f70357e1a8ed51ad6c2577e922a6bc981aad9300 Mon Sep 17 00:00:00 2001
From: Kasper Svendsen <kaspersv@github.com>
Date: Mon, 26 Oct 2026 12:19:19 +0100
Subject: [PATCH] CPP: Disable dynamic join ordering for select predicates

---
 .../lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll   | 1 +
 .../lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll   | 2 ++
 .../cpp/rangeanalysis/new/internal/semantic/analysis/Bound.qll  | 1 +
 3 files changed, 4 insertions(+)

diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 17c3438f098a..74016233dfae 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -315,6 +315,7 @@ private module Cached {
    * Holds if `asExpr(n1) = e1` and `e1 != e2` and `n2` is the first reachable node from
    * `n1` such that `asExpr(n2) = e2`.
    */
+  pragma[no_dynamic_join_order]
   private predicate localExprFlowStepImpl(Node n1, Expr e1, Node n2, Expr e2) {
     exists(Node n, Expr e | localExprFlowSingleExprStep(n1, e1, n, e) |
       // If `n.asExpr()` and `n1.asExpr()` both resolve to the same node (which can
diff --git a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
index 86753abc5b79..df04aa4db5a4 100644
--- a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
+++ b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -1067,6 +1067,7 @@ private float getTruncatedUpperBounds(Expr expr) {
 }
 
 /** Only to be called by `getTruncatedLowerBounds`. */
+pragma[no_dynamic_join_order]
 private float getLowerBoundsImpl(Expr expr) {
   (
     exists(Expr operand, float operandLow, float positive |
@@ -1277,6 +1278,7 @@ private float getLowerBoundsImpl(Expr expr) {
 }
 
 /** Only to be called by `getTruncatedUpperBounds`. */
+pragma[no_dynamic_join_order]
 private float getUpperBoundsImpl(Expr expr) {
   (
     exists(Expr operand, float operandHigh, float positive |
diff --git a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/Bound.qll b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/Bound.qll
index 4d873e8e3b3e..41c7890d9de4 100644
--- a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/Bound.qll
+++ b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/Bound.qll
@@ -4,6 +4,7 @@ private import semmle.code.cpp.ir.ValueNumbering
 
 private newtype TBound =
   TBoundZero() or
+  pragma[no_dynamic_join_order]
   TBoundValueNumber(ValueNumber vn) {
     exists(Instruction i |
       vn.getAnInstruction() = i and