PR #40303: [Bug] Fix shm_broadcast PyCFunction descriptor corruption under JIT loads

• Repository: vllm-project/vllm
• Author: jsboige
• State: open | merged: False
• Link: https://github.com/vllm-project/vllm/pull/40303

Description (problem / solution / changelog)

Summary

Fixes #35104.

Replaces the with _memory_fence_lock: (threading.Lock) memory barrier in shm_broadcast.memory_fence() with vllm.distributed.utils.sched_yield() — which is already imported in this same file (used by SpinCondition.wait) and provides equivalent memory-barrier guarantees without depending on the CPython class-method descriptor table.

Root cause

Under runtime C-extension loads (FlashInfer JIT autotune, Triton autotune, torch.compile), CPython 3.12's PyCFunction descriptor table can be corrupted for METH_METHOD class-bound descriptors. The next acquire on _thread.lock.__enter__ then crashes with:

SystemError: attempting to create PyCFunction with class but no METH_METHOD flag

This kills the worker, which surfaces as repeated shm_broadcast.py:733 No available shared memory broadcast block found in 60 seconds warnings (typically 3x), then EngineDeadError propagates and tears down the engine.

The exact failing line:

# vllm/distributed/device_communicators/shm_broadcast.py:72 (current main)
with _memory_fence_lock:
    pass

which is invoked from memory_fence() on every shared-memory message exchange.

We observed 9 such crashes in 50h of production traffic on Qwen3.6-35B-A3B-AWQ (v0.19.1.dev45+gf6983f01d) with --tensor-parallel-size 2 --enable-expert-parallel. Setting --no-enable-flashinfer-autotune reduced frequency (49 min uptime vs 25 min) but did not eliminate it — Triton autotune and torch.compile also dlopen .so at runtime.

Why sched_yield()

The original implementation relied on threading.Lock purely as a memory barrier (the lock is uncontended; with lock: pass is a hot no-op around the acquire/release). That puts a _thread.lock.__enter__ C-method call on every memory_fence() invocation, which is precisely the METH_METHOD class-bound descriptor type that gets corrupted in #35104.

sched_yield() already exists in vllm/distributed/utils.py:

def sched_yield():
    if USE_SCHED_YIELD:
        os.sched_yield()
    else:
        time.sleep(0)

It's already imported into shm_broadcast.py and used by SpinCondition.wait for the busy-loop. Using it for memory_fence() too:

• Provides the same sequentially consistent memory barrier semantics — a kernel scheduling boundary is a full memory barrier on x86-64, ARM64, and POWER (the platforms vLLM cares about).
• Same overhead as the original (~20ns; the comment in utils.py measures os.sched_yield at ~3e-7 s).
• Avoids the METH_METHOD class-bound descriptor path entirely — os.sched_yield and time.sleep are module-level functions, not bound methods, so they don't have METH_METHOD set and aren't subject to the descriptor table corruption.

_memory_fence_lock is kept as an unused module-level symbol so any external code that touches it doesn't break.

Validation

Built a custom image from nightly v0.19.1.dev45+gf6983f01d with this patch applied and ran it under real production traffic on Qwen3.6-35B-A3B-AWQ:

• TP=2 + EP=2, FP8 KV cache, 262K context, AWQ Marlin MoE
• 655-1854 prompt tok/s, 87% prefix cache hit rate
• --no-enable-flashinfer-autotune set defensively (orthogonal to this patch)
• --gdn-prefill-backend triton set defensively (orthogonal)

Will update with 24h and 48h soak results in #35104.

Risk

Very low.

• The change is isolated to vllm/distributed/device_communicators/shm_broadcast.py (+9 / -11).
• Public function signature (memory_fence()) is unchanged.
• Memory barrier semantics are equivalent.
• Uses an existing helper that's already exercised in the same file.
• _memory_fence_lock symbol kept (unused) for backward-compat.

History

The first version of this PR introduced a custom _make_memory_barrier() helper using ctypes to call libc.sched_yield / kernel32.SwitchToThread directly, with a threading.Lock fallback. After @gemini-code-assist caught a deadlock in the fallback (acquire() or release() short-circuits and never releases), I noticed the file already imports the much simpler vllm.distributed.utils.sched_yield() helper, which avoids the entire ctypes complexity. Force-pushed the simplified version.

Test plan

• 3h+ stability under real production load on Qwen3.6-35B-A3B (TP=2 + EP=2)
• 24h soak (in progress — update on #35104)
• 48h soak (in progress — update on #35104)
• CI: existing shm_broadcast tests should pass unchanged

cc @kitaekatt @slippersss (per #35104 thread)

Changed files

• vllm/distributed/device_communicators/shm_broadcast.py (modified, +9/-11)