Skip to content

[Bug]: EAGLE Spec Decoding + Structured Outputs causes FSM Crash #27210

@Pradyun92

Description

@Pradyun92

Your current environment

vLLM 0.11.x , on H200s

--2025-10-20 22:19:16-- https://raw.githubusercontent.com/vllm-project/vllm/main/vllm/collect_env.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.111.133, 185.199.108.133, 185.199.109.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 28050 (27K) [text/plain]
Saving to: ‘collect_env.py’

collect_env. 0% 0 --.-KB/s collect_env. 100% 27.39K --.-KB/s in 0s

2025-10-20 22:19:17 (185 MB/s) - ‘collect_env.py’ saved [28050/28050]

Collecting environment information...

    System Info

==============================
OS : Ubuntu 24.04.2 LTS (x86_64)
GCC version : (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0
Clang version : Could not collect
CMake version : version 4.1.0
Libc version : glibc-2.39

==============================
PyTorch Info

PyTorch version : 2.8.0+cu128
Is debug build : False
CUDA used to build PyTorch : 12.8
ROCM used to build PyTorch : N/A

==============================
Python Environment

Python version : 3.12.3 (main, Aug 14 2025, 17:47:21) [GCC 13.3.0] (64-bit runtime)
Python platform : Linux-6.14.0-1014-aws-x86_64-with-glibc2.39

==============================
CUDA / GPU Info

Is CUDA available : True
CUDA runtime version : 12.9.86
CUDA_MODULE_LOADING set to : LAZY
GPU models and configuration :
GPU 0: NVIDIA H200
GPU 1: NVIDIA H200
GPU 2: NVIDIA H200
GPU 3: NVIDIA H200
GPU 4: NVIDIA H200
GPU 5: NVIDIA H200
GPU 6: NVIDIA H200
GPU 7: NVIDIA H200

Nvidia driver version : 570.172.08
cuDNN version : Could not collect
HIP runtime version : N/A
MIOpen runtime version : N/A
Is XNNPACK available : True

==============================
CPU Info

Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Address sizes: 46 bits physical, 48 bits virtual
Byte Order: Little Endian
CPU(s): 192
On-line CPU(s) list: 0-191
Vendor ID: GenuineIntel
Model name: Intel(R) Xeon(R) Platinum 8488C
CPU family: 6
Model: 143
Thread(s) per core: 2
Core(s) per socket: 48
Socket(s): 2
Stepping: 8
BogoMIPS: 4800.00
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq monitor ssse3 fma cx16 pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch ssbd ibrs ibpb stibp ibrs_enhanced fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves avx_vnni avx512_bf16 wbnoinvd ida arat avx512vbmi umip pku ospke waitpkg avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg tme avx512_vpopcntdq rdpid cldemote movdiri movdir64b md_clear serialize amx_bf16 avx512_fp16 amx_tile amx_int8 flush_l1d arch_capabilities
Hypervisor vendor: KVM
Virtualization type: full
L1d cache: 4.5 MiB (96 instances)
L1i cache: 3 MiB (96 instances)
L2 cache: 192 MiB (96 instances)
L3 cache: 210 MiB (2 instances)
NUMA node(s): 2
NUMA node0 CPU(s): 0-47,96-143
NUMA node1 CPU(s): 48-95,144-191
Vulnerability Gather data sampling: Not affected
Vulnerability Ghostwrite: Not affected
Vulnerability Indirect target selection: Not affected
Vulnerability Itlb multihit: Not affected
Vulnerability L1tf: Not affected
Vulnerability Mds: Not affected
Vulnerability Meltdown: Not affected
Vulnerability Mmio stale data: Not affected
Vulnerability Reg file data sampling: Not affected
Vulnerability Retbleed: Not affected
Vulnerability Spec rstack overflow: Not affected
Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl
Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI BHI_DIS_S
Vulnerability Srbds: Not affected
Vulnerability Tsx async abort: Not affected

==============================
Versions of relevant libraries

[pip3] flashinfer-python==0.4.1
[pip3] numpy==2.2.6
[pip3] nvidia-cublas-cu12==12.8.4.1
[pip3] nvidia-cuda-cupti-cu12==12.8.90
[pip3] nvidia-cuda-nvrtc-cu12==12.8.93
[pip3] nvidia-cuda-runtime-cu12==12.8.90
[pip3] nvidia-cudnn-cu12==9.10.2.21
[pip3] nvidia-cudnn-frontend==1.13.0
[pip3] nvidia-cufft-cu12==11.3.3.83
[pip3] nvidia-cufile-cu12==1.13.1.3
[pip3] nvidia-curand-cu12==10.3.9.90
[pip3] nvidia-cusolver-cu12==11.7.3.90
[pip3] nvidia-cusparse-cu12==12.5.8.93
[pip3] nvidia-cusparselt-cu12==0.7.1
[pip3] nvidia-cutlass-dsl==4.2.1
[pip3] nvidia-ml-py==12.575.51
[pip3] nvidia-nccl-cu12==2.27.3
[pip3] nvidia-nvjitlink-cu12==12.8.93
[pip3] nvidia-nvshmem-cu12==3.3.9
[pip3] nvidia-nvtx-cu12==12.8.90
[pip3] pynvml==12.0.0
[pip3] pytorch-triton==3.4.0+git11ec6354
[pip3] pyzmq==27.1.0
[pip3] torch==2.8.0
[pip3] torchaudio==2.8.0
[pip3] torchvision==0.23.0
[pip3] transformers==4.56.1
[pip3] triton==3.4.0
[conda] Could not collect

==============================
vLLM Info

ROCM Version : Could not collect
vLLM Version : 0.11.1rc2.dev165+g6cce4698e (git sha: 6cce469)
vLLM Build Flags:
CUDA Archs: Not Set; ROCm: Disabled
GPU Topology:
GPU0 GPU1 GPU2 GPU3 GPU4 GPU5GPU6 GPU7 CPU Affinity NUMA Affinity GPU NUMA ID
GPU0 X NV18 NV18 NV18 NV18 NV18NV18 NV18 0-47,96-143 0 N/A
GPU1 NV18 X NV18 NV18 NV18 NV18NV18 NV18 0-47,96-143 0 N/A
GPU2 NV18 NV18 X NV18 NV18 NV18NV18 NV18 0-47,96-143 0 N/A
GPU3 NV18 NV18 NV18 X NV18 NV18NV18 NV18 0-47,96-143 0 N/A
GPU4 NV18 NV18 NV18 NV18 X NV18NV18 NV18 48-95,144-191 1 N/A
GPU5 NV18 NV18 NV18 NV18 NV18 X NV18 NV18 48-95,144-191 1 N/A
GPU6 NV18 NV18 NV18 NV18 NV18 NV18 X NV18 48-95,144-191 1 N/A
GPU7 NV18 NV18 NV18 NV18 NV18 NV18NV18 X 48-95,144-191 1 N/A

Legend:

X = Self
SYS = Connection traversing PCIe as well as the SMP interconnect between NUMA nodes (e.g., QPI/UPI)
NODE = Connection traversing PCIe as well as the interconnect between PCIe Host Bridges within a NUMA node
PHB = Connection traversing PCIe as well as a PCIe Host Bridge (typically the CPU)
PXB = Connection traversing multiple PCIe bridges (without traversing the PCIe Host Bridge)
PIX = Connection traversing at most a single PCIe bridge
NV# = Connection traversing a bonded set of # NVLinks

==============================
Environment Variables

LD_LIBRARY_PATH=/usr/local/cuda-12.9/lib64:/usr/local/cuda-12.8/lib:/usr/local/cuda-12.8/lib64:/usr/local/cuda-12.8:/usr/local/cuda-12.8/targets/x86_64-linux/lib/:/usr/local/cuda-12.8/extras/CUPTI/lib64:/opt/amazon/efa/lib:/opt/amazon/openmpi/lib:/opt/amazon/ofi-nccl/lib/x86_64-linux-gnu:/usr/local/lib:/usr/lib
CUDA_HOME=/usr/local/cuda-12.9
CUDA_HOME=/usr/local/cuda-12.9
PYTORCH_NVML_BASED_CUDA_CHECK=1
TORCHINDUCTOR_COMPILE_THREADS=1
CUDA_MODULE_LOADING=LAZY

🐛 Describe the bug

Issue

When using Eagle speculative decoding with structured output (tool calling), vLLM crashes with AssertionError when the FSM rejects a spec token that is present in the scheduled_spec_decode_tokens list.

Full Stack Trace

[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [backend_xgrammar.py:159] Failed to advance FSM for request chatcmpl-e85b68e4c00e4fb1bbeddfd122f5b3de for tokens 497. Please file an issue.

[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795] Traceback (most recent call last):
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]   File "/home/ubuntu/vllm/vllm/v1/engine/core.py", line 786, in run_engine_core
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]     engine_core.run_busy_loop()
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]   File "/home/ubuntu/vllm/vllm/v1/engine/core.py", line 813, in run_busy_loop
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]     self._process_engine_step()
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]   File "/home/ubuntu/vllm/vllm/v1/engine/core.py", line 842, in _process_engine_step
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]     outputs, model_executed = self.step_fn()
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]                               ^^^^^^^^^^^^^^
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]   File "/home/ubuntu/vllm/vllm/v1/engine/core.py", line 320, in step
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]     scheduler_output = self.scheduler.schedule()
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]                        ^^^^^^^^^^^^^^^^^^^^^^^^^
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]   File "/home/ubuntu/vllm/vllm/v1/core/sched/scheduler.py", line 615, in schedule
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]     structured_output_request_ids, grammar_bitmask = self.get_grammar_bitmask(
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]                                                      ^^^^^^^^^^^^^^^^^^^^^^^^^
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]   File "/home/ubuntu/vllm/vllm/v1/core/sched/scheduler.py", line 897, in get_grammar_bitmask
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]     bitmask = self.structured_output_manager.grammar_bitmask(
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]   File "/home/ubuntu/vllm/vllm/v1/structured_output/__init__.py", line 263, in grammar_bitmask
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]     assert structured_output_request.grammar.accept_tokens(
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795]            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[EngineCore_DP0 pid=2404644] ERROR 10-20 15:33:04 [core.py:795] AssertionError

[APIServer pid=2404466] ERROR 10-20 15:33:04 [async_llm.py:533] AsyncLLM output_handler failed.
[APIServer pid=2404466] ERROR 10-20 15:33:04 [async_llm.py:533] Traceback (most recent call last):
[APIServer pid=2404466] ERROR 10-20 15:33:04 [async_llm.py:533]   File "/home/ubuntu/vllm/vllm/v1/engine/async_llm.py", line 487, in output_handler
[APIServer pid=2404466] ERROR 10-20 15:33:04 [async_llm.py:533]     outputs = await engine_core.get_output_async()
[APIServer pid=2404466] ERROR 10-20 15:33:04 [async_llm.py:533]               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[APIServer pid=2404466] ERROR 10-20 15:33:04 [async_llm.py:533]   File "/home/ubuntu/vllm/vllm/v1/engine/core_client.py", line 882, in get_output_async
[APIServer pid=2404466] ERROR 10-20 15:33:04 [async_llm.py:533]     raise self._format_exception(outputs) from None
[APIServer pid=2404466] ERROR 10-20 15:33:04 [async_llm.py:533] vllm.v1.engine.exceptions.EngineDeadError: EngineCore encountered an issue. See stack trace (above) for the root cause.
[APIServer pid=2404466] INFO:     127.0.0.1:48250 - "POST /v1/chat/completions HTTP/1.1" 500 Internal Server Error

Critical crash point:

File "/home/ubuntu/vllm/vllm/v1/structured_output/__init__.py", line 263, in grammar_bitmask
    assert structured_output_request.grammar.accept_tokens(
AssertionError

Error

ERROR: Failed to advance FSM for request ... for tokens XXX. Please file an issue.
AssertionError at vllm/v1/structured_output/__init__.py line 263

Potential Root Cause

Potential inconsistency in xgrammar's GrammarMatcher.rollback() that fails to reset the terminated flag when rolling back past a token that terminated the FSM. This causes the FSM to remain in a "terminated" state even after rolling back to a non-terminated state.

Debugging logs

(I added some debug statements after incorporating the defensive fallback logic below to inspect the problematic tokens)

[16:01:19] /project/cpp/grammar_matcher.cc:371: Warning: The matcher has terminated after accepting the stop token, but is trying to accept new token with id 198.

[APIServer pid=2417014] INFO 10-20 16:01:19 [metrics.py:100] SpecDecoding metrics: Mean acceptance length: 2.22, Accepted throughput: 474.87 tokens/s, Drafted throughput: 1939.16 tokens/s, Accepted: 4749 tokens, Drafted: 19393 tokens, Per-position acceptance rate: 0.577, 0.302, 0.171, 0.107, 0.064, Avg Draft acceptance rate: 24.5%

[EngineCore_DP0 pid=2417186] ERROR 10-20 16:01:20 [backend_xgrammar.py:159] Failed to advance FSM for request chatcmpl-83d721aea8a34274a568c73f7fa2040f for tokens 330. Please file an issue.

[EngineCore_DP0 pid=2417186] WARNING 10-20 16:01:20 [eagle_structured_output_patch.py:189] [FSM DEBUG] Request chatcmpl-83d721aea8a34274a568c73f7fa2040f: Token 330 REJECTED in grammar_bitmask! FSM State: terminated_before=False, terminated_after=False, processed_before=6, processed_after=6. Token Context: scheduled_tokens=[330], token_index=0/1, state_advancements_so_far=0. This indicates an FSM state mismatch in Eagle + structured output. Continuing without advancing grammar state to avoid crash.

Analysis

  1. 16:01:19: xgrammar warning shows FSM terminated after accepting stop token, then tried to accept token 198
  2. 16:01:20: Token 330 rejected even though FSM reports terminated=False and has processed=6 tokens

It looks like:

  • FSM terminated during earlier validation (accepted stop token)
  • xgrammar's rollback() was called to rewind FSM state
  • Bug: rollback correctly rewound state to position 6, but failed to reset internal terminated_ flag
  • Result: xgrammar internally thinks FSM is terminated, vLLM wrapper thinks it's not
  • When trying to accept token 330, xgrammar's accept_token() checks terminated flag first, sees true, returns false

Reproduction

Setup:

  • Model: Qwen3-Coder-30B with FP8 quantization
  • Eagle speculative decoding enabled (num_speculative_tokens: 5)
  • Structured output enabled (--enable-auto-tool-choice)
  • Load: Multiple concurrent requests with tool calling

Trigger:

  • Use Eagle + structured output under load
  • Wait for FSM to hit a terminating token during validation
  • Next accept_tokens() call fails on a valid token that passed earlier validation

Proposed Fix

Replace assertion with defensive conditional check in vllm/v1/structured_output/__init__.py:

# ORIGINAL (crashes):
assert structured_output_request.grammar.accept_tokens(req_id, [token])
state_advancements += 1

# POTENTIAL FIX (defensive approach):
if structured_output_request.grammar.accept_tokens(req_id, [token]):
    state_advancements += 1
else:
    # Token rejected by FSM even though it's in scheduled list
    # Root cause: xgrammar rollback bug with terminated flag
    logger.debug(
        f"Grammar rejected spec token {token} for request {req_id}. "
        "FSM state mismatch in Eagle + structured output. "
        "Continuing without advancing grammar state."
    )
    # Continue to fill bitmasks for all tokens (required by downstream code)

Before submitting a new issue...

  • Make sure you already searched for relevant issues, and asked the chatbot living at the bottom right corner of the documentation page, which can answer lots of frequently asked questions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions