From 292e993b4a84d9a4affba538643ad376a8f36064 Mon Sep 17 00:00:00 2001
From: Albin Bernhardsson <[email protected]>
Date: Mon, 22 Jun 2026 09:55:52 -0700
Subject: [PATCH] Vulkan: Fix device loss handling

Always wait for the device work to finish and destroy its objects before
destroying the device, even when the device is lost. This is required in
Vulkan according to spec.

Bug: 500417361
Change-Id: I89cedcd15b660a1a4e9a62099fc22e56c1c37a37
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/314796
Reviewed-by: Corentin Wallez <[email protected]>
Reviewed-by: David Neto <[email protected]>
Commit-Queue: David Neto <[email protected]>
---
diff --git a/src/dawn/native/Device.cpp b/src/dawn/native/Device.cpp
index dc2cda7..6c73110 100644
--- a/src/dawn/native/Device.cpp
+++ b/src/dawn/native/Device.cpp
@@ -668,14 +668,8 @@
         AppendDeviceLostMessage(error.get());
     }
 
-    // If ErrorInjectorEnabled() then this may be an injected DeviceLost, not a real one.
-    bool deviceDefinitelyStopped = type == InternalErrorType::DeviceLost && !ErrorInjectorEnabled();
-    if (deviceDefinitelyStopped) {
-        // If the device was lost naturally, the backend device has already stopped.
-        mState = State::Disconnected;
-    }
-
     InternalErrorType allowedErrors = InternalErrorType::Validation | additionalAllowedErrors;
+
     if (!(allowedErrors & type)) {
         // If we receive an error which we did not explicitly allow, assume the backend can't
         // recover and lose the device now. Cleanup for the device will be deferred until the last
@@ -684,9 +678,14 @@
                              allowedErrors);
 
         // Handle the remainder of this error as if it caused a device lost.
+        type = InternalErrorType::DeviceLost;
+    }
+
+    if (type == InternalErrorType::DeviceLost) {
+        // Transition to a non-alive state if we are currently alive so that the application can no
+        // longer use the device.
         State prev = State::Alive;
         mState.compare_exchange_strong(prev, State::BeingDisconnected, std::memory_order::acq_rel);
-        type = InternalErrorType::DeviceLost;
     }
 
     // Re-enable validation on device loss or OOM to avoid unpredictable behaviors afterwards.
diff --git a/src/dawn/native/Device.h b/src/dawn/native/Device.h
index 5d4a5cb..1689ea2 100644
--- a/src/dawn/native/Device.h
+++ b/src/dawn/native/Device.h
@@ -344,7 +344,7 @@
     //   - Alive: the device is usable and might have work happening on the GPU timeline.
     //   - BeingDisconnected: the device is no longer usable because we are waiting for all
     //     work on the GPU timeline to finish. (this is to make validation prevent the
-    //     application from adding more work during the transition from Available to
+    //     application from adding more work during the transition from Alive to
     //     Disconnected)
     //   - Disconnected: there is no longer work happening on the GPU timeline and the CPU data
     //     structures can be safely destroyed without additional synchronization.
diff --git a/src/dawn/native/Toggles.cpp b/src/dawn/native/Toggles.cpp
index 5ade3d6..5db3805 100644
--- a/src/dawn/native/Toggles.cpp
+++ b/src/dawn/native/Toggles.cpp
@@ -804,6 +804,10 @@
      {"metal_fix_u32_div_mod",
       "Workaround a driver bug on Apple Silicon with u32 div and mod operations.",
       "https://crbug.com/517225032", ToggleStage::Device}},
+    {Toggle::VulkanSleepAfterLostDeviceWait,
+     {"vulkan_sleep_after_lost_device_wait",
+      "Insert an arbitrary sleep after WaitIdle functions on device loss.",
+      "https://crbug.com/500417361", ToggleStage::Device}},
     {Toggle::WaitIsThreadSafe,
      {"wait_is_thread_safe",
       "WaitFor* functions are thread-safe and can be called without the device-lock if implicit "
diff --git a/src/dawn/native/Toggles.h b/src/dawn/native/Toggles.h
index 2d1020e..9e71492 100644
--- a/src/dawn/native/Toggles.h
+++ b/src/dawn/native/Toggles.h
@@ -191,6 +191,7 @@
     VulkanForceStaticSamplersForExternalTextures,
     D3D12UseHLSL2021,
     MetalFixU32DivMod,
+    VulkanSleepAfterLostDeviceWait,
 
     // Once all backends have been updated to be thread safe for waiting, we can remove this toggle.
     WaitIsThreadSafe,
diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
index e38794b..aab9be9 100644
--- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
+++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
@@ -1083,6 +1083,10 @@
         // instructions as matrix elements instead of a source/dest pointee elements.
         // See crbug.com/460209126
         deviceToggles->Default(Toggle::VulkanCooperativeMatrixStrideIsMatrixElements, true);
+
+        // dawn:500417361
+        // TODO: Add details once available.
+        deviceToggles->Default(Toggle::VulkanSleepAfterLostDeviceWait, true);
     }
 
     if (IsAndroidSamsung() || IsAndroidQualcomm() || IsAndroidHuawei()) {
diff --git a/src/dawn/native/vulkan/QueueVk.cpp b/src/dawn/native/vulkan/QueueVk.cpp
index 36c7433..642bf58 100644
--- a/src/dawn/native/vulkan/QueueVk.cpp
+++ b/src/dawn/native/vulkan/QueueVk.cpp
@@ -49,6 +49,7 @@
 #include "src/dawn/native/vulkan/VulkanError.h"
 #include "src/dawn/platform/metrics/HistogramMacros.h"
 #include "src/dawn/platform/tracing/TraceEvent.h"
+#include "src/dawn/utils/SystemUtils.h"
 #include "src/utils/compiler.h"
 
 namespace dawn::native::vulkan {
@@ -177,8 +178,12 @@
     // Ignore the result of QueueWaitIdle: it can return OOM which we can't really do anything
     // about, Device lost, which means workloads running on the GPU are no longer accessible
     // (so they are as good as waited on) or success.
-    [[maybe_unused]] VkResult waitIdleResult =
-        VkResult::WrapUnsafe(device->fn.QueueWaitIdle(mQueue));
+    VkResult waitIdleResult = VkResult::WrapUnsafe(device->fn.QueueWaitIdle(mQueue));
+
+    if (waitIdleResult == VK_ERROR_DEVICE_LOST &&
+        GetDevice()->IsToggleEnabled(Toggle::VulkanSleepAfterLostDeviceWait)) {
+        dawn::utils::USleep(1000);
+    }
 
     DAWN_TRY(WaitForQueueSerial(GetLastSubmittedCommandSerial(),
                                 std::numeric_limits<Nanoseconds>::max()));