vllm - ✅(Solved) Fix [Bug]: Async double streaming_update with shared-prefix reuse can leave invalid -1 token ids in the worker input row [1 pull requests, 3 comments, 3 participants]

NeilAlfred · 2026-05-13T06:50:23Z

[vllm] I found a frontend-legal request-lifecycle bug in the resumable streaming update path. The reproducer sends one live request req2 and then legally updat… I found a frontend-legal request-lifecycle bug in the resumable `streaming_update` path. The reproducer sends one live request (`req2`) and then legally updates the same request twice with `streaming_update`. While those two updates are being processed, async queue lag and shared-prefix reuse are both still active. Under that combination, vLLM rebuilds the renewed `req2` state, schedules speculative placeholder tokens for it, but the worker-side input row is no longer fully backed by real token ids. As a result, the prepared host-side input row for `req2` contains `-1` values before model execution starts. On the re-verified Qwen3 standalone run, the visible non-blocking failure is a CUDA `device-side assert` in the FlashAttention execution path. The important point is that the bad row already exists before the GPU failure. This is not a random backend crash, and it is not the same issue as the same-id placeholder-underflow bug or the older prompt-width overflow bug. # PR #42519: [Bugfix] Fix async double streaming_update placeholder bug (#42490) - Repository: vllm-project/vllm - Author: zhougit86 - State: open | merged: False - Link: https://github.com/vllm-project/vllm/pull/42519 ## Description (problem / solution / changelog) This commit fixes a critical race condition where async double streaming updates combined with shared-prefix reuse could leave invalid -1 token ids in the worker's input row, triggering CUDA device-side asserts. The issue occurred because `_update_streaming_request` was calling `remove_request`, which erroneously cleared `prev_req_id_to_index` for the request. When the async scheduler later generated speculative placeholders (-1), the worker could not find the previous index to scatter the real tokens over them in `_prepare_input_ids`. We fixed this by adding a `keep_prev_index` flag to `remove_request` and setting it to True during streaming updates. A unit test reproducing the race condition locally on CPU has been added. Co-authored-by: Claude ## Purpose Fixes #42490. This PR resolves a race condition in the v1 engine that causes a `CUDA error: device-side assert triggered` during `flash_attn_varlen_func`. The crash happens under a specific combination of features: 1. **Async Scheduling (Queue Lag)** 2. **Double Streaming Updates** (multiple consecutive `streaming_update` on the same live request) 3. **Shared-prefix Reuse (APC)** **Root Cause**: When the worker processes the streaming update via `_update_streaming_request`, it calls `remove_request(req_id)`, which wipes the request's historical index from `prev_req_id_to_index`. Later, when the async scheduler allocates speculative placeholders (Token ID `-1`) for the queued updates, the worker writes these `-1`s to CPU memory. During `_prepare_input_ids`, the worker tries to overwrite these `-1` placeholders with real tokens using a scatter operation, but because `prev_req_id_to_index` was wiped, it fails to locate the correct historical index. The uninitialized `-1` leaks into the final GPU input tensor, crashing the attention backend. **Fix**: Added a `keep_prev_index` parameter to `InputBatch.remove_request()` to allow preserving the historical index mapping. We set `keep_prev_index=True` in `GPUModelRunner._update_streaming_request` since the GPU state from the previous step is still valid and required for the scatter logic. ## Test Plan 1. Added a local CPU-only unit test `test_async_double_streaming_update_placeholder_bug` in `tests/v1/streaming_input/test_gpu_model_runner_streaming.py` to directly mock the `GPUModelRunner` and simulate the async double update state transition. 2. The test verifies that `prev_req_id_to_index` mapping is properly retained after `_update_streaming_request`. Command to run the targeted test: ```bash pytest tests/v1/streaming_input/test_gpu_model_runner_streaming.py::test_async_double_streaming_update_placeholder_bug ``` ## Test Result - **Before this PR**: The newly added unit test fails because `req_id not in runner.input_batch.prev_req_id_to_index` (the state mapping is lost, leading to the `-1` leak). - **After this PR**: The unit test passes perfectly (`1 passed`), confirming the mapping is retained. Furthermore, existing streaming test suites (`tests/v1/streaming_input/`) continue to pass without regression. --- Essential Elements of an Effective PR Description Checklist - [x] The purpose of the PR, such as "Fix some issue (link existing issues this PR will resolve)". - [x] The test plan, such as providing test command. - [x] The test results, such as pasting the results comparison before and after, or e2e results - [ ] (Optional) The necessary documentation update, such as updating `supported_models.md` and `examples` for a new model. ## Changed files - `tes

vllm2026-05-13 06:50:23

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

vllm-project/vllm#42490•Fetched 2026-05-14 03:29:43

View on GitHub

Comments

Participants

Timeline

Reactions

Author

Participants

Timeline (top)

referenced ×4commented ×3cross-referenced ×1labeled ×1

I found a frontend-legal request-lifecycle bug in the resumable streaming_update path.

The reproducer sends one live request (req2) and then legally updates the same request twice with streaming_update. While those two updates are being processed, async queue lag and shared-prefix reuse are both still active.

Under that combination, vLLM rebuilds the renewed req2 state, schedules speculative placeholder tokens for it, but the worker-side input row is no longer fully backed by real token ids. As a result, the prepared host-side input row for req2 contains -1 values before model execution starts.

On the re-verified Qwen3 standalone run, the visible non-blocking failure is a CUDA device-side assert in the FlashAttention execution path.

The important point is that the bad row already exists before the GPU failure. This is not a random backend crash, and it is not the same issue as the same-id placeholder-underflow bug or the older prompt-width overflow bug.

Error Message

File ".../vllm/v1/attention/backends/flash_attn.py", line 724, in forward flash_attn_varlen_func( File ".../vllm/vllm_flash_attn/flash_attn_interface.py", line 300, in flash_attn_varlen_func out, softmax_lse = torch.ops._vllm_fa2_C.varlen_fwd( torch.AcceleratorError: CUDA error: device-side assert triggered

Root Cause

This is not a malformed-input bug, and it is not a random GPU-only failure.

The problem is that vLLM legally continues the same live request twice through streaming_update, while async queued work from the earlier state is still in flight and shared-prefix reuse is still active. Under that combination, the renewed req2 state and the worker-side input row stop agreeing with each other.

In the verified run, the scheduler still treats some future positions for req2 as valid placeholder-backed tokens, but the worker-side row that is prepared for the next model step is no longer fully backed by real token ids. That is why -1 values are already present in the prepared host-side row before the model executes.

So the real bug is in how the renewed request state, async placeholder-backed future output, and worker-side row reconstruction interact. The later CUDA device-side assert is the consequence of the model consuming that already-bad row.

Fix Action

Fix / Workaround

============================== CPU Info

Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Address sizes: 52 bits physical, 57 bits virtual Byte Order: Little Endian CPU(s): 384 On-line CPU(s) list: 0-383 Vendor ID: AuthenticAMD Model name: AMD EPYC 9654 96-Core Processor CPU family: 25 Model: 17 Thread(s) per core: 2 Core(s) per socket: 96 Socket(s): 2 Stepping: 1 Frequency boost: enabled CPU max MHz: 3707.8120 CPU min MHz: 1500.0000 BogoMIPS: 4792.57 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good amd_lbr_v2 nopl nonstop_tsc cpuid extd_apicid aperfmperf rapl pni pclmulqdq monitor ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb cat_l3 cdp_l3 invpcid_single hw_pstate ssbd mba perfmon_v2 ibrs ibpb stibp ibrs_enhanced vmmcall fsgsbase bmi1 avx2 smep bmi2 erms invpcid cqm rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local avx512_bf16 clzero irperf xsaveerptr rdpru wbnoinvd amd_ppin cppc arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif x2avic v_spec_ctrl vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq la57 rdpid overflow_recov succor smca fsrm flush_l1d Virtualization: AMD-V L1d cache: 6 MiB (192 instances) L1i cache: 6 MiB (192 instances) L2 cache: 192 MiB (192 instances) L3 cache: 768 MiB (24 instances) NUMA node(s): 2 NUMA node0 CPU(s): 0-95,192-287 NUMA node1 CPU(s): 96-191,288-383 Vulnerability Gather data sampling: Not affected Vulnerability Itlb multihit: Not affected Vulnerability L1tf: Not affected Vulnerability Mds: Not affected Vulnerability Meltdown: Not affected Vulnerability Mmio stale data: Not affected Vulnerability Retbleed: Not affected Vulnerability Spec rstack overflow: Mitigation; Safe RET Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization Vulnerability Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; STIBP always-on; RSB filling; PBRSB-eIBRS Not affected; BHI Not affected Vulnerability Srbds: Not affected Vulnerability Tsx async abort: Not affected

PR fix notes

PR #42519: [Bugfix] Fix async double streaming_update placeholder bug (#42490)

Repository: vllm-project/vllm
Author: zhougit86
State: open | merged: False
Link: https://github.com/vllm-project/vllm/pull/42519

Description (problem / solution / changelog)

This commit fixes a critical race condition where async double streaming updates combined with shared-prefix reuse could leave invalid -1 token ids in the worker's input row, triggering CUDA device-side asserts.

The issue occurred because _update_streaming_request was calling remove_request, which erroneously cleared prev_req_id_to_index for the request. When the async scheduler later generated speculative placeholders (-1), the worker could not find the previous index to scatter the real tokens over them in _prepare_input_ids.

We fixed this by adding a keep_prev_index flag to remove_request and setting it to True during streaming updates. A unit test reproducing the race condition locally on CPU has been added.

Co-authored-by: Claude

Purpose

Fixes #42490.

This PR resolves a race condition in the v1 engine that causes a CUDA error: device-side assert triggered during flash_attn_varlen_func. The crash happens under a specific combination of features:

Async Scheduling (Queue Lag)
Double Streaming Updates (multiple consecutive streaming_update on the same live request)
Shared-prefix Reuse (APC)

Root Cause: When the worker processes the streaming update via _update_streaming_request, it calls remove_request(req_id), which wipes the request's historical index from prev_req_id_to_index. Later, when the async scheduler allocates speculative placeholders (Token ID -1) for the queued updates, the worker writes these -1s to CPU memory. During _prepare_input_ids, the worker tries to overwrite these -1 placeholders with real tokens using a scatter operation, but because prev_req_id_to_index was wiped, it fails to locate the correct historical index. The uninitialized -1 leaks into the final GPU input tensor, crashing the attention backend.

Fix: Added a keep_prev_index parameter to InputBatch.remove_request() to allow preserving the historical index mapping. We set keep_prev_index=True in GPUModelRunner._update_streaming_request since the GPU state from the previous step is still valid and required for the scatter logic.

Test Plan

Added a local CPU-only unit test test_async_double_streaming_update_placeholder_bug in tests/v1/streaming_input/test_gpu_model_runner_streaming.py to directly mock the GPUModelRunner and simulate the async double update state transition.
The test verifies that prev_req_id_to_index mapping is properly retained after _update_streaming_request.

Command to run the targeted test:

pytest tests/v1/streaming_input/test_gpu_model_runner_streaming.py::test_async_double_streaming_update_placeholder_bug

Test Result

Before this PR: The newly added unit test fails because req_id not in runner.input_batch.prev_req_id_to_index (the state mapping is lost, leading to the -1 leak).
After this PR: The unit test passes perfectly (1 passed), confirming the mapping is retained. Furthermore, existing streaming test suites (tests/v1/streaming_input/) continue to pass without regression.

<details> <summary> Essential Elements of an Effective PR Description Checklist </summary>

The purpose of the PR, such as "Fix some issue (link existing issues this PR will resolve)".
The test plan, such as providing test command.
The test results, such as pasting the results comparison before and after, or e2e results
(Optional) The necessary documentation update, such as updating supported_models.md and examples for a new model.

</details>

Changed files

tests/v1/streaming_input/test_gpu_model_runner_streaming.py (modified, +62/-0)
vllm/v1/worker/gpu_input_batch.py (modified, +5/-2)
vllm/v1/worker/gpu_model_runner.py (modified, +1/-1)

Code Example

Collecting environment information...
==============================
        System Info
==============================
OS                           : Ubuntu 22.04.5 LTS (x86_64)
GCC version                  : (Ubuntu 13.1.0-8ubuntu1~22.04) 13.1.0
Clang version                : 16.0.6 (++20231112100510+7cbf1a259152-1~exp1~20231112100554.106)
CMake version                : version 3.22.1
Libc version                 : glibc-2.35

==============================
       PyTorch Info
==============================
PyTorch version              : 2.10.0+cu128
Is debug build               : False
CUDA used to build PyTorch   : 12.8
ROCM used to build PyTorch   : N/A
XPU used to build PyTorch    : N/A

==============================
      Python Environment
==============================
Python version               : 3.12.9 | packaged by Anaconda, Inc. | (main, Feb  6 2025, 18:56:27) [GCC 11.2.0] (64-bit runtime)
Python platform              : Linux-6.5.0-35-generic-x86_64-with-glibc2.35
    
==============================
       CUDA / GPU Info
==============================
Is CUDA available            : True
CUDA runtime version         : 12.8.61
CUDA_MODULE_LOADING set to   : 
GPU models and configuration : 
GPU 0: NVIDIA GeForce RTX 4090
GPU 1: NVIDIA GeForce RTX 4090

Nvidia driver version        : 570.86.10
cuDNN version                : Probably one of the following:
/usr/lib/x86_64-linux-gnu/libcudnn.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_adv.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_cnn.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_engines_precompiled.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_engines_runtime_compiled.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_graph.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_heuristic.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_ops.so.9.3.0
HIP runtime version          : N/A
MIOpen runtime version       : N/A
Is XNNPACK available         : True

==============================
          CPU Info
==============================
Architecture:                       x86_64
CPU op-mode(s):                     32-bit, 64-bit
Address sizes:                      52 bits physical, 57 bits virtual
Byte Order:                         Little Endian
CPU(s):                             384
On-line CPU(s) list:                0-383
Vendor ID:                          AuthenticAMD
Model name:                         AMD EPYC 9654 96-Core Processor
CPU family:                         25
Model:                              17
Thread(s) per core:                 2
Core(s) per socket:                 96
Socket(s):                          2
Stepping:                           1
Frequency boost:                    enabled
CPU max MHz:                        3707.8120
CPU min MHz:                        1500.0000
BogoMIPS:                           4792.57
Flags:                              fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good amd_lbr_v2 nopl nonstop_tsc cpuid extd_apicid aperfmperf rapl pni pclmulqdq monitor ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb cat_l3 cdp_l3 invpcid_single hw_pstate ssbd mba perfmon_v2 ibrs ibpb stibp ibrs_enhanced vmmcall fsgsbase bmi1 avx2 smep bmi2 erms invpcid cqm rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local avx512_bf16 clzero irperf xsaveerptr rdpru wbnoinvd amd_ppin cppc arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif x2avic v_spec_ctrl vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq la57 rdpid overflow_recov succor smca fsrm flush_l1d
Virtualization:                     AMD-V
L1d cache:                          6 MiB (192 instances)
L1i cache:                          6 MiB (192 instances)
L2 cache:                           192 MiB (192 instances)
L3 cache:                           768 MiB (24 instances)
NUMA node(s):                       2
NUMA node0 CPU(s):                  0-95,192-287
NUMA node1 CPU(s):                  96-191,288-383
Vulnerability Gather data sampling: Not affected
Vulnerability Itlb multihit:        Not affected
Vulnerability L1tf:                 Not affected
Vulnerability Mds:                  Not affected
Vulnerability Meltdown:             Not affected
Vulnerability Mmio stale data:      Not affected
Vulnerability Retbleed:             Not affected
Vulnerability Spec rstack overflow: Mitigation; Safe RET
Vulnerability Spec store bypass:    Mitigation; Speculative Store Bypass disabled via prctl
Vulnerability Spectre v1:           Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2:           Mitigation; Enhanced / Automatic IBRS; IBPB conditional; STIBP always-on; RSB filling; PBRSB-eIBRS Not affected; BHI Not affected
Vulnerability Srbds:                Not affected
Vulnerability Tsx async abort:      Not affected

==============================
Versions of relevant libraries
==============================
[pip3] flashinfer-python==0.6.4
[pip3] numpy==2.0.2
[pip3] nvidia-cublas-cu12==12.8.4.1
[pip3] nvidia-cuda-cupti-cu12==12.8.90
[pip3] nvidia-cuda-nvrtc-cu12==12.8.93
[pip3] nvidia-cuda-runtime-cu12==12.8.90
[pip3] nvidia-cudnn-cu12==9.10.2.21
[pip3] nvidia-cudnn-frontend==1.18.0
[pip3] nvidia-cufft-cu12==11.3.3.83
[pip3] nvidia-cufile-cu12==1.13.1.3
[pip3] nvidia-curand-cu12==10.3.9.90
[pip3] nvidia-cusolver-cu12==11.7.3.90
[pip3] nvidia-cusparse-cu12==12.5.8.93
[pip3] nvidia-cusparselt-cu12==0.7.1
[pip3] nvidia-cutlass-dsl==4.4.2
[pip3] nvidia-cutlass-dsl-libs-base==4.4.2
[pip3] nvidia-ml-py==13.590.48
[pip3] nvidia-nccl-cu12==2.27.5
[pip3] nvidia-nvjitlink-cu12==12.8.93
[pip3] nvidia-nvshmem-cu12==3.4.5
[pip3] nvidia-nvtx-cu12==12.8.90
[pip3] optree==0.15.0
[pip3] pyzmq==27.1.0
[pip3] torch==2.10.0+cu128
[pip3] torch_c_dlpack_ext==0.1.5
[pip3] torchaudio==2.10.0+cu128
[pip3] torchvision==0.25.0+cu128
[pip3] transformers==4.56.1
[pip3] triton==3.6.0
[conda] flashinfer-python         0.6.4                    pypi_0    pypi
[conda] numpy                     2.0.2                    pypi_0    pypi
[conda] nvidia-cublas-cu12        12.8.4.1                 pypi_0    pypi
[conda] nvidia-cuda-cupti-cu12    12.8.90                  pypi_0    pypi
[conda] nvidia-cuda-nvrtc-cu12    12.8.93                  pypi_0    pypi
[conda] nvidia-cuda-runtime-cu12  12.8.90                  pypi_0    pypi
[conda] nvidia-cudnn-cu12         9.10.2.21                pypi_0    pypi
[conda] nvidia-cudnn-frontend     1.18.0                   pypi_0    pypi
[conda] nvidia-cufft-cu12         11.3.3.83                pypi_0    pypi
[conda] nvidia-cufile-cu12        1.13.1.3                 pypi_0    pypi
[conda] nvidia-curand-cu12        10.3.9.90                pypi_0    pypi
[conda] nvidia-cusolver-cu12      11.7.3.90                pypi_0    pypi
[conda] nvidia-cusparse-cu12      12.5.8.93                pypi_0    pypi
[conda] nvidia-cusparselt-cu12    0.7.1                    pypi_0    pypi
[conda] nvidia-cutlass-dsl        4.4.2                    pypi_0    pypi
[conda] nvidia-cutlass-dsl-libs-base 4.4.2                    pypi_0    pypi
[conda] nvidia-ml-py              13.590.48                pypi_0    pypi
[conda] nvidia-nccl-cu12          2.27.5                   pypi_0    pypi
[conda] nvidia-nvjitlink-cu12     12.8.93                  pypi_0    pypi
[conda] nvidia-nvshmem-cu12       3.4.5                    pypi_0    pypi
[conda] nvidia-nvtx-cu12          12.8.90                  pypi_0    pypi
[conda] optree                    0.15.0                   pypi_0    pypi
[conda] pyzmq                     27.1.0                   pypi_0    pypi
[conda] torch                     2.10.0+cu128             pypi_0    pypi
[conda] torch-c-dlpack-ext        0.1.5                    pypi_0    pypi
[conda] torchaudio                2.10.0+cu128             pypi_0    pypi
[conda] torchvision               0.25.0+cu128             pypi_0    pypi
[conda] transformers              4.56.1                   pypi_0    pypi
[conda] triton                    3.6.0                    pypi_0    pypi

==============================
         vLLM Info
==============================
ROCM Version                 : Could not collect
vLLM Version                 : 0.17.1
vLLM Build Flags:
  CUDA Archs: 8.9; ROCm: Disabled; XPU: Disabled
GPU Topology:
        GPU0    GPU1    CPU Affinity    NUMA Affinity   GPU NUMA ID
GPU0     X      NODE    96-191,288-383  1               N/A
GPU1    NODE     X      96-191,288-383  1               N/A

Legend:

  X    = Self
  SYS  = Connection traversing PCIe as well as the SMP interconnect between NUMA nodes (e.g., QPI/UPI)
  NODE = Connection traversing PCIe as well as the interconnect between PCIe Host Bridges within a NUMA node
  PHB  = Connection traversing PCIe as well as a PCIe Host Bridge (typically the CPU)
  PXB  = Connection traversing multiple PCIe bridges (without traversing the PCIe Host Bridge)
  PIX  = Connection traversing at most a single PCIe bridge
  NV#  = Connection traversing a bonded set of # NVLinks

==============================
     Environment Variables
==============================
TORCH_CUDA_ARCH_LIST=8.9
CUDA_PATH=/usr/local/cuda
LD_LIBRARY_PATH=/usr/local/cuda/lib64:/home/neil/code/llm/llama.cpp/build-cuda/bin
CUDA_HOME=/usr/local/cuda
CUDA_HOME=/usr/local/cuda
CUDAToolkit_ROOT=/usr/local/cuda
PYTORCH_NVML_BASED_CUDA_CHECK=1
TORCHINDUCTOR_COMPILE_THREADS=1
TORCHINDUCTOR_CACHE_DIR=/tmp/torchinductor_neil

---

# vllm/v1/engine/output_processor.py
   def apply_streaming_update(self, update: StreamingUpdate) -> None:
       if self.prompt_token_ids:
           self.prompt_token_ids.extend(update.prompt_token_ids or ())
       else:
           self.prompt_token_ids = update.prompt_token_ids or []
       self.prompt_len = len(self.prompt_token_ids)

---

# vllm/v1/core/sched/scheduler.py
   kept_output_tokens = session._all_token_ids[
       session.num_prompt_tokens : num_computed_tokens
   ]
   session.prompt_token_ids.extend(kept_output_tokens)
   session._all_token_ids.extend(update.prompt_token_ids or ())
   session.prompt_token_ids.extend(update.prompt_token_ids or ())

---

# vllm/v1/core/sched/async_scheduler.py
   cur_num_spec_tokens = len(spec_decode_tokens.get(req_id, ()))
   request.num_output_placeholders += 1 + cur_num_spec_tokens
   request.spec_token_ids = self._spec_token_placeholders

---

# vllm/v1/core/sched/scheduler.py
   num_scheduled_spec_tokens = (
       num_new_tokens
       + request.num_computed_tokens
       - request.num_tokens
       - request.num_output_placeholders
   )
   if num_scheduled_spec_tokens > 0:
       scheduled_spec_decode_tokens[request.request_id] = spec_token_ids

---

# vllm/v1/worker/gpu_model_runner.py
   prev_req_id_to_index: dict[str, int] = {}
   for i, req_id in enumerate(self.input_batch.req_ids):
       if i in discard_req_indices_set:
           continue
       prev_req_id_to_index[req_id] = i
       if (req_state := self.requests.get(req_id)) is not None:
           req_state.output_token_ids.append(-1)
   self.input_batch.prev_req_id_to_index = prev_req_id_to_index

---

# vllm/v1/worker/gpu_model_runner.py
   prev_req_id_to_index = self.input_batch.prev_req_id_to_index
   scheduled_spec_tokens = scheduler_output.scheduled_spec_decode_tokens

   for req_id, cur_index in self.input_batch.req_id_to_index.items():
       if (prev_index := prev_req_id_to_index.get(req_id)) is not None:
           draft_len = len(scheduled_spec_tokens.get(req_id, ()))
           sample_flattened_indices.append(flattened_index - draft_len)
           spec_flattened_indices.extend(
               range(flattened_index - draft_len + 1, flattened_index + 1)
           )

---

# vllm/v1/attention/backends/flash_attn.py
   flash_attn_varlen_func(
       q=query[:num_actual_tokens],
       k=key_cache,
       v=value_cache,
       out=output[:num_actual_tokens],
       ...
   )

---

export POC_PY=/path/to/python3
export G11_LOCAL=/path/to/repro_g11_cp64_placeholder_local.py
export VLLM_POC_G11_MODEL=/path/to/qwen3

CUDA_VISIBLE_DEVICES=0 "$POC_PY" "$G11_LOCAL" \
  --model "$VLLM_POC_G11_MODEL" \
  --run-name g11_cp64_placeholder_local

---

CUDA_VISIBLE_DEVICES=0 CUDA_LAUNCH_BLOCKING=1 "$POC_PY" "$G11_LOCAL" \
  --model "$VLLM_POC_G11_MODEL" \
  --run-name g11_cp64_placeholder_blocking \
  --blocking

---

File ".../vllm/v1/attention/backends/flash_attn.py", line 724, in forward
    flash_attn_varlen_func(
  File ".../vllm/vllm_flash_attn/flash_attn_interface.py", line 300, in flash_attn_varlen_func
    out, softmax_lse = torch.ops._vllm_fa2_C.varlen_fwd(
torch.AcceleratorError: CUDA error: device-side assert triggered

RAW_BUFFERClick to expand / collapse

Your current environment

<details> <summary>The output of <code>python collect_env.py</code></summary>

Collecting environment information...
==============================
        System Info
==============================
OS                           : Ubuntu 22.04.5 LTS (x86_64)
GCC version                  : (Ubuntu 13.1.0-8ubuntu1~22.04) 13.1.0
Clang version                : 16.0.6 (++20231112100510+7cbf1a259152-1~exp1~20231112100554.106)
CMake version                : version 3.22.1
Libc version                 : glibc-2.35

==============================
       PyTorch Info
==============================
PyTorch version              : 2.10.0+cu128
Is debug build               : False
CUDA used to build PyTorch   : 12.8
ROCM used to build PyTorch   : N/A
XPU used to build PyTorch    : N/A

==============================
      Python Environment
==============================
Python version               : 3.12.9 | packaged by Anaconda, Inc. | (main, Feb  6 2025, 18:56:27) [GCC 11.2.0] (64-bit runtime)
Python platform              : Linux-6.5.0-35-generic-x86_64-with-glibc2.35
    
==============================
       CUDA / GPU Info
==============================
Is CUDA available            : True
CUDA runtime version         : 12.8.61
CUDA_MODULE_LOADING set to   : 
GPU models and configuration : 
GPU 0: NVIDIA GeForce RTX 4090
GPU 1: NVIDIA GeForce RTX 4090

Nvidia driver version        : 570.86.10
cuDNN version                : Probably one of the following:
/usr/lib/x86_64-linux-gnu/libcudnn.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_adv.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_cnn.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_engines_precompiled.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_engines_runtime_compiled.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_graph.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_heuristic.so.9.3.0
/usr/lib/x86_64-linux-gnu/libcudnn_ops.so.9.3.0
HIP runtime version          : N/A
MIOpen runtime version       : N/A
Is XNNPACK available         : True

==============================
          CPU Info
==============================
Architecture:                       x86_64
CPU op-mode(s):                     32-bit, 64-bit
Address sizes:                      52 bits physical, 57 bits virtual
Byte Order:                         Little Endian
CPU(s):                             384
On-line CPU(s) list:                0-383
Vendor ID:                          AuthenticAMD
Model name:                         AMD EPYC 9654 96-Core Processor
CPU family:                         25
Model:                              17
Thread(s) per core:                 2
Core(s) per socket:                 96
Socket(s):                          2
Stepping:                           1
Frequency boost:                    enabled
CPU max MHz:                        3707.8120
CPU min MHz:                        1500.0000
BogoMIPS:                           4792.57
Flags:                              fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good amd_lbr_v2 nopl nonstop_tsc cpuid extd_apicid aperfmperf rapl pni pclmulqdq monitor ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb cat_l3 cdp_l3 invpcid_single hw_pstate ssbd mba perfmon_v2 ibrs ibpb stibp ibrs_enhanced vmmcall fsgsbase bmi1 avx2 smep bmi2 erms invpcid cqm rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local avx512_bf16 clzero irperf xsaveerptr rdpru wbnoinvd amd_ppin cppc arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif x2avic v_spec_ctrl vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq la57 rdpid overflow_recov succor smca fsrm flush_l1d
Virtualization:                     AMD-V
L1d cache:                          6 MiB (192 instances)
L1i cache:                          6 MiB (192 instances)
L2 cache:                           192 MiB (192 instances)
L3 cache:                           768 MiB (24 instances)
NUMA node(s):                       2
NUMA node0 CPU(s):                  0-95,192-287
NUMA node1 CPU(s):                  96-191,288-383
Vulnerability Gather data sampling: Not affected
Vulnerability Itlb multihit:        Not affected
Vulnerability L1tf:                 Not affected
Vulnerability Mds:                  Not affected
Vulnerability Meltdown:             Not affected
Vulnerability Mmio stale data:      Not affected
Vulnerability Retbleed:             Not affected
Vulnerability Spec rstack overflow: Mitigation; Safe RET
Vulnerability Spec store bypass:    Mitigation; Speculative Store Bypass disabled via prctl
Vulnerability Spectre v1:           Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2:           Mitigation; Enhanced / Automatic IBRS; IBPB conditional; STIBP always-on; RSB filling; PBRSB-eIBRS Not affected; BHI Not affected
Vulnerability Srbds:                Not affected
Vulnerability Tsx async abort:      Not affected

==============================
Versions of relevant libraries
==============================
[pip3] flashinfer-python==0.6.4
[pip3] numpy==2.0.2
[pip3] nvidia-cublas-cu12==12.8.4.1
[pip3] nvidia-cuda-cupti-cu12==12.8.90
[pip3] nvidia-cuda-nvrtc-cu12==12.8.93
[pip3] nvidia-cuda-runtime-cu12==12.8.90
[pip3] nvidia-cudnn-cu12==9.10.2.21
[pip3] nvidia-cudnn-frontend==1.18.0
[pip3] nvidia-cufft-cu12==11.3.3.83
[pip3] nvidia-cufile-cu12==1.13.1.3
[pip3] nvidia-curand-cu12==10.3.9.90
[pip3] nvidia-cusolver-cu12==11.7.3.90
[pip3] nvidia-cusparse-cu12==12.5.8.93
[pip3] nvidia-cusparselt-cu12==0.7.1
[pip3] nvidia-cutlass-dsl==4.4.2
[pip3] nvidia-cutlass-dsl-libs-base==4.4.2
[pip3] nvidia-ml-py==13.590.48
[pip3] nvidia-nccl-cu12==2.27.5
[pip3] nvidia-nvjitlink-cu12==12.8.93
[pip3] nvidia-nvshmem-cu12==3.4.5
[pip3] nvidia-nvtx-cu12==12.8.90
[pip3] optree==0.15.0
[pip3] pyzmq==27.1.0
[pip3] torch==2.10.0+cu128
[pip3] torch_c_dlpack_ext==0.1.5
[pip3] torchaudio==2.10.0+cu128
[pip3] torchvision==0.25.0+cu128
[pip3] transformers==4.56.1
[pip3] triton==3.6.0
[conda] flashinfer-python         0.6.4                    pypi_0    pypi
[conda] numpy                     2.0.2                    pypi_0    pypi
[conda] nvidia-cublas-cu12        12.8.4.1                 pypi_0    pypi
[conda] nvidia-cuda-cupti-cu12    12.8.90                  pypi_0    pypi
[conda] nvidia-cuda-nvrtc-cu12    12.8.93                  pypi_0    pypi
[conda] nvidia-cuda-runtime-cu12  12.8.90                  pypi_0    pypi
[conda] nvidia-cudnn-cu12         9.10.2.21                pypi_0    pypi
[conda] nvidia-cudnn-frontend     1.18.0                   pypi_0    pypi
[conda] nvidia-cufft-cu12         11.3.3.83                pypi_0    pypi
[conda] nvidia-cufile-cu12        1.13.1.3                 pypi_0    pypi
[conda] nvidia-curand-cu12        10.3.9.90                pypi_0    pypi
[conda] nvidia-cusolver-cu12      11.7.3.90                pypi_0    pypi
[conda] nvidia-cusparse-cu12      12.5.8.93                pypi_0    pypi
[conda] nvidia-cusparselt-cu12    0.7.1                    pypi_0    pypi
[conda] nvidia-cutlass-dsl        4.4.2                    pypi_0    pypi
[conda] nvidia-cutlass-dsl-libs-base 4.4.2                    pypi_0    pypi
[conda] nvidia-ml-py              13.590.48                pypi_0    pypi
[conda] nvidia-nccl-cu12          2.27.5                   pypi_0    pypi
[conda] nvidia-nvjitlink-cu12     12.8.93                  pypi_0    pypi
[conda] nvidia-nvshmem-cu12       3.4.5                    pypi_0    pypi
[conda] nvidia-nvtx-cu12          12.8.90                  pypi_0    pypi
[conda] optree                    0.15.0                   pypi_0    pypi
[conda] pyzmq                     27.1.0                   pypi_0    pypi
[conda] torch                     2.10.0+cu128             pypi_0    pypi
[conda] torch-c-dlpack-ext        0.1.5                    pypi_0    pypi
[conda] torchaudio                2.10.0+cu128             pypi_0    pypi
[conda] torchvision               0.25.0+cu128             pypi_0    pypi
[conda] transformers              4.56.1                   pypi_0    pypi
[conda] triton                    3.6.0                    pypi_0    pypi

==============================
         vLLM Info
==============================
ROCM Version                 : Could not collect
vLLM Version                 : 0.17.1
vLLM Build Flags:
  CUDA Archs: 8.9; ROCm: Disabled; XPU: Disabled
GPU Topology:
        GPU0    GPU1    CPU Affinity    NUMA Affinity   GPU NUMA ID
GPU0     X      NODE    96-191,288-383  1               N/A
GPU1    NODE     X      96-191,288-383  1               N/A

Legend:

  X    = Self
  SYS  = Connection traversing PCIe as well as the SMP interconnect between NUMA nodes (e.g., QPI/UPI)
  NODE = Connection traversing PCIe as well as the interconnect between PCIe Host Bridges within a NUMA node
  PHB  = Connection traversing PCIe as well as a PCIe Host Bridge (typically the CPU)
  PXB  = Connection traversing multiple PCIe bridges (without traversing the PCIe Host Bridge)
  PIX  = Connection traversing at most a single PCIe bridge
  NV#  = Connection traversing a bonded set of # NVLinks

==============================
     Environment Variables
==============================
TORCH_CUDA_ARCH_LIST=8.9
CUDA_PATH=/usr/local/cuda
LD_LIBRARY_PATH=/usr/local/cuda/lib64:/home/neil/code/llm/llama.cpp/build-cuda/bin
CUDA_HOME=/usr/local/cuda
CUDA_HOME=/usr/local/cuda
CUDAToolkit_ROOT=/usr/local/cuda
PYTORCH_NVML_BASED_CUDA_CHECK=1
TORCHINDUCTOR_COMPILE_THREADS=1
TORCHINDUCTOR_CACHE_DIR=/tmp/torchinductor_neil

</details>

🐛 Describe the bug

Describe the bug

Version: vLLM 0.17.1
Model: Qwen/Qwen3-0.6B-GPTQ-Int8
Hardware reproduced on: NVIDIA GeForce RTX 4090, single GPU

Summary

I found a frontend-legal request-lifecycle bug in the resumable streaming_update path.

On the re-verified Qwen3 standalone run, the visible non-blocking failure is a CUDA device-side assert in the FlashAttention execution path.

Trigger chain

Submit req0 and req1 so the engine is already running a live mixed batch.
Submit req2 as a resumable late request.
Send a first legal streaming_update for the same live req2.
Let async scheduling queue work for the current mixed batch, but do not drain all queued work yet.
Send a second legal streaming_update for the same live req2 while shared-prefix reuse is still active.
vLLM rebuilds the renewed req2, but the worker-side row for req2 no longer has real token ids for every placeholder-backed position.
The prepared host-side row already contains -1 values.
When model execution consumes that row, the run fails with a CUDA device-side assert.

Details

Trigger path in code

The request state accepts legal streaming continuation and appends the new prompt fragment to the existing request state.

# vllm/v1/engine/output_processor.py
def apply_streaming_update(self, update: StreamingUpdate) -> None:
    if self.prompt_token_ids:
        self.prompt_token_ids.extend(update.prompt_token_ids or ())
    else:
        self.prompt_token_ids = update.prompt_token_ids or []
    self.prompt_len = len(self.prompt_token_ids)

In the scheduler path, resumable session handling keeps already-computed output tokens, folds them back into the same request's prompt, and then appends the new update tokens.

# vllm/v1/core/sched/scheduler.py
kept_output_tokens = session._all_token_ids[
    session.num_prompt_tokens : num_computed_tokens
]
session.prompt_token_ids.extend(kept_output_tokens)
session._all_token_ids.extend(update.prompt_token_ids or ())
session.prompt_token_ids.extend(update.prompt_token_ids or ())

This is why the bug is about a renewed live request, not a brand-new unrelated request.

Under async scheduling, vLLM adds output placeholders for each scheduled request, including speculative decode positions.

# vllm/v1/core/sched/async_scheduler.py
cur_num_spec_tokens = len(spec_decode_tokens.get(req_id, ()))
request.num_output_placeholders += 1 + cur_num_spec_tokens
request.spec_token_ids = self._spec_token_placeholders

The scheduler then exposes those placeholder-backed speculative positions in scheduled_spec_decode_tokens.

# vllm/v1/core/sched/scheduler.py
num_scheduled_spec_tokens = (
    num_new_tokens
    + request.num_computed_tokens
    - request.num_tokens
    - request.num_output_placeholders
)
if num_scheduled_spec_tokens > 0:
    scheduled_spec_decode_tokens[request.request_id] = spec_token_ids

On the worker side, async scheduling constructs prev_req_id_to_index from the previous batch rows and appends placeholder -1 tokens to per-request cached output state.

# vllm/v1/worker/gpu_model_runner.py
prev_req_id_to_index: dict[str, int] = {}
for i, req_id in enumerate(self.input_batch.req_ids):
    if i in discard_req_indices_set:
        continue
    prev_req_id_to_index[req_id] = i
    if (req_state := self.requests.get(req_id)) is not None:
        req_state.output_token_ids.append(-1)
self.input_batch.prev_req_id_to_index = prev_req_id_to_index

Later, _prepare_input_ids() tries to reconstruct the next-step input row by mapping current request ids back to the previous batch rows and by replaying speculative positions.

# vllm/v1/worker/gpu_model_runner.py
prev_req_id_to_index = self.input_batch.prev_req_id_to_index
scheduled_spec_tokens = scheduler_output.scheduled_spec_decode_tokens

for req_id, cur_index in self.input_batch.req_id_to_index.items():
    if (prev_index := prev_req_id_to_index.get(req_id)) is not None:
        draft_len = len(scheduled_spec_tokens.get(req_id, ()))
        sample_flattened_indices.append(flattened_index - draft_len)
        spec_flattened_indices.extend(
            range(flattened_index - draft_len + 1, flattened_index + 1)
        )

In this issue, the renewed req2 still has placeholder-backed future positions, but the worker can no longer fully materialize every one of those positions into a real token-backed row. The host-side prepared row already carries -1 values before execution enters the attention backend.

The visible failure then occurs when the model consumes that row in the FlashAttention path.

# vllm/v1/attention/backends/flash_attn.py
flash_attn_varlen_func(
    q=query[:num_actual_tokens],
    k=key_cache,
    v=value_cache,
    out=output[:num_actual_tokens],
    ...
)

The re-verified standalone run ends here with CUDA error: device-side assert triggered.

Local script breakdown

repro_g11_cp64_placeholder_local.py is a standalone local reproducer.

It reads the Qwen3 checkpoint path from VLLM_POC_G11_MODEL or the built-in /path/to/qwen3 placeholder
It creates one EngineCore directly
It submits:
- one anchor request
- one overlapping peer request
- one resumable late request
The late request is submitted as:
- chunk 0
- first same-request streaming_update
- second same-request streaming_update
It preserves async queue lag between the first and second update
It also preserves shared-prefix reuse for the late request
It writes:
- campaign.json
- repro_config.json
- request_history.json
- request_states.json
- action_log.json
- post_run_summary.json
- error.txt on failure

Local repro

Official Hugging Face repo: Qwen/Qwen3-0.6B-GPTQ-Int8
Please download Qwen3-0.6B-GPTQ-Int8 and run my reproduce script repro_g11_cp64_placeholder_local.py

export POC_PY=/path/to/python3
export G11_LOCAL=/path/to/repro_g11_cp64_placeholder_local.py
export VLLM_POC_G11_MODEL=/path/to/qwen3

CUDA_VISIBLE_DEVICES=0 "$POC_PY" "$G11_LOCAL" \
  --model "$VLLM_POC_G11_MODEL" \
  --run-name g11_cp64_placeholder_local

Optional blocking attribution:

CUDA_VISIBLE_DEVICES=0 CUDA_LAUNCH_BLOCKING=1 "$POC_PY" "$G11_LOCAL" \
  --model "$VLLM_POC_G11_MODEL" \
  --run-name g11_cp64_placeholder_blocking \
  --blocking

Reproduce Environment

Item	Value
OS	Ubuntu 22.04.5 LTS
Kernel	Linux 6.5.0-35-generic
GPU	2 x NVIDIA GeForce RTX 4090
GPU memory	24564 MiB each
Driver	570.86.10
CUDA runtime	12.8 (`nvidia-smi`)
CUDA toolkit	12.8.61 (`nvcc`)
Python	3.12.9
vLLM	0.17.1
PyTorch	2.10.0+cu128
transformers	4.56.1
tokenizers	0.22.0
flash_attn	2.8.3
triton	3.6.0
numpy	2.0.2

Observed result

Representative traceback from the re-verified non-blocking standalone run:

  File ".../vllm/v1/attention/backends/flash_attn.py", line 724, in forward
    flash_attn_varlen_func(
  File ".../vllm/vllm_flash_attn/flash_attn_interface.py", line 300, in flash_attn_varlen_func
    out, softmax_lse = torch.ops._vllm_fa2_C.varlen_fwd(
torch.AcceleratorError: CUDA error: device-side assert triggered

Root cause

This is not a malformed-input bug, and it is not a random GPU-only failure.

Attachments

The attachment bundle for this report should contain:

repro_g11_cp64_placeholder_local.py

Before submitting a new issue...

Make sure you already searched for relevant issues, and asked the chatbot living at the bottom right corner of the documentation page, which can answer lots of frequently asked questions.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#api #mixed precision #training loop #device allocation #environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.