react-native-webgpu 0.9.0 → 0.10.1

package/cpp/jsi/NativeObject.h

@@ -8,14 +8,14 @@
 #include <jsi/jsi.h>
 #include <memory>
 #include <mutex>
-#include <optional>
 #include <stdexcept>
 #include <string>
 #include <type_traits>
+#include <typeindex>
 #include <unordered_map>
 #include <utility>
 
-#include "RuntimeAwareCache.h"
+#include "JSICache.h"
 #include "WGPULogger.h"
 
 // Forward declare to avoid circular dependency
@@ -74,50 +74,6 @@ private:
   std::unordered_map<std::string, InstallerFunc> _installers;
 };
 
-/**
- * Per-runtime cache entry for a prototype object.
- * Uses std::optional<jsi::Object> so the prototype is stored directly
- * without extra indirection.
- */
-struct PrototypeCacheEntry {
-  std::optional<jsi::Object> prototype;
-};
-
-/**
- * Wrapper for static RuntimeAwareCache that handles hot reload.
- *
- * When used with static storage (like prototype caches), the cache persists
- * across hot reloads. But the JSI objects inside become invalid when the
- * runtime is destroyed. This wrapper tracks which main-runtime generation the
- * cache was created for and allocates a new cache when the native module is
- * reinstalled (RNWebGPUManager construction bumps the generation).
- *
- * The generation is used instead of the runtime pointer on purpose: on an
- * in-process runtime recreate (expo-updates reloadAsync, DevSettings.reload)
- * Hermes frequently allocates the new runtime at the address of the freed
- * one. A pointer comparison then sees "same runtime", keeps the stale cache,
- * and installConstructor() ends up touching a jsi::Object owned by the dead
- * runtime (SIGSEGV in jsi::Value::~Value, see issue #461).
- *
- * The old cache is intentionally leaked - we cannot safely destroy JSI
- * objects after their runtime is gone.
- */
-template <typename T> struct StaticRuntimeAwareCache {
-  RuntimeAwareCache<T> *cache = nullptr;
-  uint64_t cacheGeneration = 0;
-
-  RuntimeAwareCache<T> &get(jsi::Runtime & /*rt*/) {
-    auto generation = BaseRuntimeAwareCache::getMainJsRuntimeGeneration();
-    if (cache == nullptr || cacheGeneration != generation) {
-      // First use, or the main runtime was reinstalled (hot reload / OTA):
-      // allocate a fresh cache and leak the old one.
-      cache = new RuntimeAwareCache<T>();
-      cacheGeneration = generation;
-    }
-    return *cache;
-  }
-};
-
 /**
  * BoxedWebGPUObject is a HostObject wrapper that holds a reference to ANY
  * WebGPU NativeObject. This is used for Reanimated/Worklets serialization.
@@ -243,29 +199,20 @@ public:
   using IsNativeObject = std::true_type;
 
   /**
-   * Get the prototype cache for this type.
-   * Each NativeObject<Derived> type has its own static cache.
-   * Uses StaticRuntimeAwareCache to properly handle runtime lifecycle
-   * and hot reload (where the main runtime is destroyed and recreated).
-   *
-   * Callers must hold getPrototypeCacheMutex(): the cache is reached
-   * concurrently from the main JS thread (create()) and from worklet
-   * runtime threads (BoxedWebGPUObject::unbox() -> installPrototype()).
+   * Key under which this class's prototype is stored in the per-runtime
+   * JSICache: the C++ type of Derived.
    */
-  static RuntimeAwareCache<PrototypeCacheEntry> &
-  getPrototypeCache(jsi::Runtime &runtime) {
-    static StaticRuntimeAwareCache<PrototypeCacheEntry> cache;
-    return cache.get(runtime);
+  static JSICache::PrototypeKey prototypeKey() {
+    return std::type_index(typeid(Derived));
   }
 
   /**
-   * Per-class mutex guarding getPrototypeCache() and prototype
-   * installation. Serializes the StaticRuntimeAwareCache pointer swap
-   * (hot reload) and the per-runtime cache lookups.
+   * Returns this class's prototype on `runtime`, or nullptr if it has not
+   * been installed there yet. The prototype is owned by the runtime (see
+   * JSICache), so the pointer is valid for as long as `runtime` is.
    */
-  static std::mutex &getPrototypeCacheMutex() {
-    static std::mutex mutex;
-    return mutex;
+  static jsi::Object *getCachedPrototype(jsi::Runtime &runtime) {
+    return JSICache::get(runtime).getPrototype(prototypeKey());
   }
 
   /**
@@ -273,10 +220,8 @@ public:
    * Called automatically by create(), but can be called manually.
    */
   static void installPrototype(jsi::Runtime &runtime) {
-    std::lock_guard<std::mutex> lock(getPrototypeCacheMutex());
-    auto &entry = getPrototypeCache(runtime).get(runtime);
-    if (entry.prototype.has_value()) {
-      return; // Already installed
+    if (getCachedPrototype(runtime) != nullptr) {
+      return; // Already installed on this runtime
     }
 
     // Create prototype object
@@ -348,8 +293,8 @@ public:
         });
     prototype.setProperty(runtime, "toJSON", toJSON);
 
-    // Cache the prototype
-    entry.prototype = std::move(prototype);
+    // Hand the prototype to the runtime-owned cache
+    JSICache::get(runtime).setPrototype(prototypeKey(), std::move(prototype));
   }
 
   /**
@@ -373,9 +318,8 @@ public:
 
     installPrototype(runtime);
 
-    std::lock_guard<std::mutex> lock(getPrototypeCacheMutex());
-    auto &entry = getPrototypeCache(runtime).get(runtime);
-    if (!entry.prototype.has_value()) {
+    auto *prototype = getCachedPrototype(runtime);
+    if (prototype == nullptr) {
       return;
     }
 
@@ -391,10 +335,10 @@ public:
 
     // Set the prototype property on the constructor
     // This is what makes `instanceof` work
-    ctor.setProperty(runtime, "prototype", *entry.prototype);
+    ctor.setProperty(runtime, "prototype", *prototype);
 
     // Set constructor property on prototype pointing back to constructor
-    entry.prototype->setProperty(runtime, "constructor", ctor);
+    prototype->setProperty(runtime, "constructor", ctor);
 
     // Install on global
     runtime.global().setProperty(runtime, Derived::CLASS_NAME, std::move(ctor));
@@ -417,17 +361,11 @@ public:
     obj.setNativeState(runtime, instance);
 
     // Set prototype
-    {
-      std::lock_guard<std::mutex> lock(getPrototypeCacheMutex());
-      auto &entry = getPrototypeCache(runtime).get(runtime);
-      if (entry.prototype.has_value()) {
-        // Use Object.setPrototypeOf to set the prototype
-        auto objectCtor =
-            runtime.global().getPropertyAsObject(runtime, "Object");
-        auto setPrototypeOf =
-            objectCtor.getPropertyAsFunction(runtime, "setPrototypeOf");
-        setPrototypeOf.call(runtime, obj, *entry.prototype);
-      }
+    if (auto *prototype = getCachedPrototype(runtime)) {
+      auto objectCtor = runtime.global().getPropertyAsObject(runtime, "Object");
+      auto setPrototypeOf =
+          objectCtor.getPropertyAsFunction(runtime, "setPrototypeOf");
+      setPrototypeOf.call(runtime, obj, *prototype);
     }
 
     // Set memory pressure hint for GC

package/cpp/rnwgpu/RNWebGPUManager.cpp

@@ -61,9 +61,6 @@ RNWebGPUManager::RNWebGPUManager(
     : _jsRuntime(jsRuntime), _jsCallInvoker(jsCallInvoker),
       _platformContext(platformContext) {
 
-  // Register main runtime for RuntimeAwareCache
-  BaseRuntimeAwareCache::setMainJsRuntime(_jsRuntime);
-
   // Register the main runtime + its CallInvoker so spontaneous events
   // (device.lost / uncapturederror) on main-runtime devices can be delivered to
   // the JS thread without the ProcessEvents pump. Worklet-runtime devices have

package/cpp/rnwgpu/SurfaceRegistry.h

@@ -81,6 +81,10 @@ public:
   ~SurfaceInfo() {
     // Drop the Dawn objects before releasing the native surfaces they borrow.
     _surface = nullptr;
+#if defined(__ANDROID__)
+    // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+    _surfaceDevice = nullptr;
+#endif
     _pendingSurface = nullptr;
     _texture = nullptr;
     if (_pendingReleaser && _pendingNativeSurface) {
@@ -170,6 +174,10 @@ public:
       replacedSurface = _nativeSurface;
       replacedReleaser = std::move(_releaser);
       _surface = std::move(_pendingSurface);
+#if defined(__ANDROID__)
+      // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+      _surfaceDevice = nullptr;
+#endif
       _nativeSurface = _pendingNativeSurface;
       _releaser = std::move(_pendingReleaser);
       _hasPendingAttach = false;
@@ -187,7 +195,7 @@ public:
         if (blit) {
           config.usage |= wgpu::TextureUsage::CopyDst;
         }
-        _surface.Configure(&config);
+        configureSurfaceLocked(config);
 #ifdef __APPLE__
         applyCAMetalLayerColorSpace(_nativeSurface, _config.format);
 #endif
@@ -275,6 +283,38 @@ public:
     return _config.device != nullptr;
   }
 
+  // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+  // Called right before `device` is destroyed. If the Dawn surface holds a
+  // swapchain for that device, drop the surface now, while the device is
+  // still alive, and recreate an unconfigured one for the same native window
+  // so a later configure() with another device still renders on screen.
+  //
+  // Why: on Vulkan, tearing a swapchain down (SwapChain::DetachFromSurfaceImpl)
+  // goes through the device's FencedDeleter. Dawn only tears it down when the
+  // surface is reconfigured or destroyed, and Unconfigure() is not enough (it
+  // parks the swapchain as "recycled" for the next Configure). So when the
+  // native view is dropped after device.destroy(), ~Surface dereferences the
+  // dead device (SIGSEGV, fault addr 0x20). Android only: Metal's detach does
+  // not touch the device, and this must not change behaviour there.
+  //
+  // Remove once the pinned Dawn contains the upstream fix; the check in
+  // scripts/install-dawn.ts fails the install when the Dawn pin changes so
+  // that decision is not forgotten.
+  void releaseSurfaceForDevice(const wgpu::Device &device) {
+#if defined(__ANDROID__)
+    std::unique_lock<std::shared_mutex> lock(_mutex);
+    if (!_surface || !_surfaceDevice || _surfaceDevice.Get() != device.Get()) {
+      return;
+    }
+    // Left unconfigured: _config still names the destroyed device, and
+    // configuring against it would only raise a validation error. The next
+    // configure() from JS (or a surface re-attach) configures it.
+    recreateSurfaceLocked();
+#else
+    (void)device;
+#endif
+  }
+
   // True while a native view owns a surface for this context (attached or
   // pending adoption). Used to decide which side retires the registry entry:
   // the native view's teardown when a surface exists, the JS Canvas cleanup
@@ -384,6 +424,10 @@ private:
           _texture = createOffscreenTextureLocked();
         }
         _surface = nullptr;
+#if defined(__ANDROID__)
+        // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+        _surfaceDevice = nullptr;
+#endif
         // The in-flight frame (if any) rendered into the destroyed surface;
         // presentFrame() must not present it.
         _acquiredFromSurface = false;
@@ -432,7 +476,12 @@ private:
           wgpu::SurfaceGetCurrentTextureStatus::Error) {
         return nullptr;
       }
-      _surface.Configure(&_config);
+      configureSurfaceLocked(_config);
+      // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE: the reconfigure
+      // may have replaced the surface and failed to create a new one.
+      if (!_surface) {
+        return nullptr;
+      }
       _surface.GetCurrentTexture(&surfaceTexture);
       if (!isAcquireSuccess(surfaceTexture)) {
         return nullptr;
@@ -480,7 +529,7 @@ private:
 
   void _configureLocked() {
     if (_surface) {
-      _surface.Configure(&_config);
+      configureSurfaceLocked(_config);
 #ifdef __APPLE__
       applyCAMetalLayerColorSpace(_nativeSurface, _config.format);
 #endif
@@ -489,7 +538,67 @@ private:
     }
   }
 
+  // Every Surface::Configure goes through here. Once the
+  // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE lines are gone, this
+  // is a plain wrapper around _surface.Configure.
+  void configureSurfaceLocked(const wgpu::SurfaceConfiguration &config) {
+#if defined(__ANDROID__)
+    // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+    // Vulkan refuses to switch a surface to another device and keeps the old
+    // swapchain attached, so a device change (device swap, recovery after a
+    // lost device, a re-run effect) is done with a fresh surface. This also
+    // tears the old swapchain down while its device is still alive.
+    if (_surfaceDevice && _surfaceDevice.Get() != config.device.Get()) {
+      recreateSurfaceLocked();
+      if (!_surface) {
+        return;
+      }
+    }
+#endif
+    _surface.Configure(&config);
+#if defined(__ANDROID__)
+    // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+    _surfaceDevice = config.device;
+#endif
+  }
+
+#if defined(__ANDROID__)
+  // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+  // Replace _surface with a new, unconfigured surface for the same native
+  // window. Dropping the old one runs ~Surface, which detaches both the
+  // active and the recycled swapchain against their still-alive device.
+  void recreateSurfaceLocked() {
+    _surface = nullptr;
+    _surfaceDevice = nullptr;
+    // A frame acquired from the old surface can no longer be presented.
+    _acquiredFromSurface = false;
+    _frameEpoch++;
+    if (_nativeSurface) {
+      wgpu::SurfaceSourceAndroidNativeWindow source;
+      source.window = _nativeSurface;
+      wgpu::SurfaceDescriptor descriptor;
+      descriptor.nextInChain = &source;
+      _surface = _gpu.CreateSurface(&descriptor);
+    }
+  }
+#endif
+
   mutable std::shared_mutex _mutex;
+#if defined(__ANDROID__)
+  // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+  // The device _surface was last configured with. Dawn keeps a swapchain for
+  // that device inside the surface even after Unconfigure() (it is recycled
+  // for the next Configure), so this outlives _config.device on purpose and
+  // is only reset when _surface itself is dropped or replaced. Owning: Dawn
+  // destroys a device when its last external reference goes away, which
+  // would leave the swapchain with a dead device just like an explicit
+  // destroy(). Declared before _surface so it is released after it.
+  //
+  // Android only: this is an extra owning reference to the device, and on
+  // Metal (where the detach never touches the device) it would keep a
+  // device alive past its last JS reference for no reason.
+  wgpu::Device _surfaceDevice = nullptr;
+#endif
   // Attached on-screen surface (null while offscreen).
   void *_nativeSurface = nullptr;
   wgpu::Surface _surface = nullptr;
@@ -579,6 +688,30 @@ public:
     _registry.erase(it);
   }
 
+  // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+  // See SurfaceInfo::releaseSurfaceForDevice. Lock order is registry ->
+  // SurfaceInfo, matching every other path.
+  void releaseSurfacesForDevice(const wgpu::Device &device) {
+    std::vector<std::shared_ptr<SurfaceInfo>> infos;
+    {
+      // Walking _allSurfaces, not _registry: a GPUCanvasContext keeps its own
+      // shared_ptr, so an entry erased by clear() (dev reload) or by
+      // removeSurfaceInfo() can still be alive and still hold a swapchain for
+      // this device.
+      std::unique_lock<std::shared_mutex> lock(_mutex);
+      pruneAllSurfacesLocked();
+      infos.reserve(_allSurfaces.size());
+      for (auto &weak : _allSurfaces) {
+        if (auto info = weak.lock()) {
+          infos.push_back(std::move(info));
+        }
+      }
+    }
+    for (auto &info : infos) {
+      info->releaseSurfaceForDevice(device);
+    }
+  }
+
   // Drops all entries. Called when the RN instance tears down (dev reload):
   // JS context ids restart from scratch, so surviving entries would alias new
   // canvases onto dead surfaces.
@@ -600,11 +733,28 @@ private:
     }
     auto info = std::make_shared<SurfaceInfo>(gpu, width, height);
     _registry[id] = info;
+    // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+    pruneAllSurfacesLocked();
+    _allSurfaces.push_back(info);
     return info;
   }
 
+  // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+  void pruneAllSurfacesLocked() {
+    _allSurfaces.erase(
+        std::remove_if(_allSurfaces.begin(), _allSurfaces.end(),
+                       [](const std::weak_ptr<SurfaceInfo> &weak) {
+                         return weak.expired();
+                       }),
+        _allSurfaces.end());
+  }
+
   mutable std::shared_mutex _mutex;
   std::unordered_map<int, std::shared_ptr<SurfaceInfo>> _registry;
+  // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+  // Every live SurfaceInfo, including the ones no longer in _registry.
+  // Non-owning; pruned on insert and on every device destroy.
+  std::vector<std::weak_ptr<SurfaceInfo>> _allSurfaces;
 };
 
 } // namespace rnwgpu

package/cpp/rnwgpu/api/GPUAdapter.cpp

@@ -66,6 +66,48 @@ async::AsyncTaskHandle GPUAdapter::requestDevice(
     }
   }
 
+  // Request Dawn's ImplicitDeviceSynchronization feature by default. Dawn's
+  // native API is not thread-safe without it, and the react-native-wgpu model
+  // is "create the device on the JS thread, render from a worklet runtime",
+  // which uses one device from several threads. The feature wraps device and
+  // child-object entry points in a per-device mutex (command *encoding* stays
+  // unsynchronized: never share a GPUCommandEncoder across threads). Dawn
+  // exposes the feature on every physical device, but keep the support check
+  // so a hypothetical adapter without it still vends a device. Callers can opt
+  // out with `implicitDeviceSynchronization: false` on the device descriptor
+  // to skip the (small) per-call locking overhead when the device is only ever
+  // used from a single thread.
+  {
+    const bool optedOut = descriptor.has_value() &&
+                          descriptor.value()->implicitDeviceSynchronization ==
+                              std::optional<bool>(false);
+    if (!optedOut) {
+      wgpu::SupportedFeatures supported;
+      _instance.GetFeatures(&supported);
+      const bool isSupported =
+          std::find(supported.features,
+                    supported.features + supported.featureCount,
+                    wgpu::FeatureName::ImplicitDeviceSynchronization) !=
+          supported.features + supported.featureCount;
+      if (isSupported) {
+        if (!descriptor.has_value()) {
+          descriptor = std::make_shared<GPUDeviceDescriptor>();
+        }
+        auto &desc = descriptor.value();
+        if (!desc->requiredFeatures.has_value()) {
+          desc->requiredFeatures = std::vector<wgpu::FeatureName>{};
+        }
+        auto &features = desc->requiredFeatures.value();
+        if (std::find(features.begin(), features.end(),
+                      wgpu::FeatureName::ImplicitDeviceSynchronization) ==
+            features.end()) {
+          features.push_back(
+              wgpu::FeatureName::ImplicitDeviceSynchronization);
+        }
+      }
+    }
+  }
+
   wgpu::DeviceDescriptor aDescriptor;
   Convertor conv;
   if (!conv(aDescriptor, descriptor)) {
@@ -285,7 +327,7 @@ std::unordered_set<std::string> GPUAdapter::getFeatures() {
 
 std::shared_ptr<GPUSupportedLimits> GPUAdapter::getLimits() {
   wgpu::Limits limits{};
-  if (!_instance.GetLimits(&limits)) {
+  if (_instance.GetLimits(&limits) != wgpu::Status::Success) {
     throw std::runtime_error("Failed to get limits");
   }
   return std::make_shared<GPUSupportedLimits>(limits);

package/cpp/rnwgpu/api/GPUDevice.cpp

@@ -16,6 +16,7 @@
 #include "GPUOutOfMemoryError.h"
 #include "GPUValidationError.h"
 #include "RnFeatures.h"
+#include "SurfaceRegistry.h"
 
 namespace rnwgpu {
 
@@ -124,7 +125,7 @@ GPUDevice::createBuffer(std::shared_ptr<GPUBufferDescriptor> descriptor) {
 
 std::shared_ptr<GPUSupportedLimits> GPUDevice::getLimits() {
   wgpu::Limits limits{};
-  if (!_instance.GetLimits(&limits)) {
+  if (_instance.GetLimits(&limits) != wgpu::Status::Success) {
     throw std::runtime_error("failed to get device limits");
   }
   return std::make_shared<GPUSupportedLimits>(limits);
@@ -149,6 +150,10 @@ std::shared_ptr<GPUCommandEncoder> GPUDevice::createCommandEncoder(
 }
 
 void GPUDevice::destroy() {
+  // DAWN_WORKAROUND_DEVICE_DESTROY_BEFORE_SURFACE_RELEASE
+  // Any canvas surface holding a swapchain for this device must let go of it
+  // while the device is alive (see SurfaceInfo::releaseSurfaceForDevice).
+  SurfaceRegistry::getInstance().releaseSurfacesForDevice(_instance);
   _instance.Destroy();
   notifyDeviceLost(wgpu::DeviceLostReason::Destroyed, "device was destroyed");
 }

package/cpp/rnwgpu/api/GPUExternalTexture.cpp

@@ -190,7 +190,7 @@ std::shared_ptr<GPUExternalTexture> GPUExternalTexture::Create(
   wgpu::SharedTextureMemoryBeginAccessDescriptor begin{};
   begin.initialized = true;
   begin.concurrentRead = false;
-  if (!memory.BeginAccess(texture, &begin)) {
+  if (memory.BeginAccess(texture, &begin) != wgpu::Status::Success) {
     throw std::runtime_error(
         "GPUExternalTexture::Create(): BeginAccess failed");
   }
@@ -240,8 +240,7 @@ std::shared_ptr<GPUExternalTexture> GPUExternalTexture::Create(
 
   auto external = device.CreateExternalTexture(&extDesc);
   if (external == nullptr) {
-    wgpu::SharedTextureMemoryEndAccessState state{};
-    (void)memory.EndAccess(texture, &state);
+    endAccess(memory, texture);
     throw std::runtime_error(
         "GPUExternalTexture::Create(): CreateExternalTexture returned "
         "null");
@@ -289,7 +288,7 @@ std::shared_ptr<GPUExternalTexture> GPUExternalTexture::Create(
   begin.concurrentRead = false;
   wgpu::SharedTextureMemoryVkImageLayoutBeginState beginLayout{};
   begin.nextInChain = &beginLayout;
-  if (!memory.BeginAccess(texture, &begin)) {
+  if (memory.BeginAccess(texture, &begin) != wgpu::Status::Success) {
     throw std::runtime_error(
         "GPUExternalTexture::Create(): BeginAccess failed");
   }
@@ -310,7 +309,7 @@ std::shared_ptr<GPUExternalTexture> GPUExternalTexture::Create(
     wgpu::SharedTextureMemoryAHardwareBufferProperties ahbProps{};
     wgpu::SharedTextureMemoryProperties props{};
     props.nextInChain = &ahbProps;
-    if (memory.GetProperties(&props)) {
+    if (memory.GetProperties(&props) == wgpu::Status::Success) {
       yuvToRgbMatrix = makeYuvToRgbMatrix(ahbProps.yCbCrInfo.vkYCbCrModel,
                                           ahbProps.yCbCrInfo.vkYCbCrRange);
     } else {
@@ -345,8 +344,7 @@ std::shared_ptr<GPUExternalTexture> GPUExternalTexture::Create(
 
   auto external = device.CreateExternalTexture(&extDesc);
   if (external == nullptr) {
-    wgpu::SharedTextureMemoryEndAccessState state{};
-    (void)memory.EndAccess(texture, &state);
+    endAccess(memory, texture);
     throw std::runtime_error(
         "GPUExternalTexture::Create(): CreateExternalTexture returned "
         "null");

package/cpp/rnwgpu/api/GPUExternalTexture.h

@@ -58,19 +58,39 @@ public:
   // destroy() the producer's surface (e.g. an AVPlayer IOSurface) stays claimed
   // until GC runs. EndAccess is the designed post-submit call: Dawn keeps the
   // texture alive for in-flight GPU work via the fences it returns.
+  // Destroying the texture and the external texture is what actually frees
+  // the import: the ExternalTexture's views keep the imported VkImage /
+  // IOSurface texture alive until the object itself is destroyed, which
+  // otherwise only happens once the JS wrapper (and any bind group that
+  // sampled it) is garbage-collected.
   void destroy() {
     if (_memory && _texture) {
-      wgpu::SharedTextureMemoryEndAccessState state{};
-      (void)_memory.EndAccess(_texture, &state);
+      endAccess(_memory, _texture);
+    }
+    if (_texture) {
+      _texture.Destroy();
+    }
+    if (_instance) {
+      _instance.Destroy();
+    }
+    if (_texture) {
+      _texture.Destroy();
+    }
+    if (_instance) {
+      _instance.Destroy();
     }
     _texture = nullptr;
     _memory = nullptr;
+    _instance = nullptr;
+    _source = nullptr;
   }
 
   std::string getLabel() { return _label; }
   void setLabel(const std::string &label) {
     _label = label;
-    _instance.SetLabel(_label.c_str());
+    if (_instance) {
+      _instance.SetLabel(_label.c_str());
+    }
   }
 
   // Non-spec extension. A 3x4 row-major matrix mapping the *sampled* texel
@@ -97,6 +117,23 @@ public:
 
   inline const wgpu::ExternalTexture get() { return _instance; }
 
+  // End the shared-memory access window on `texture`. Shared by destroy() and
+  // the Create() error paths so every EndAccess carries the same chain: Dawn's
+  // Vulkan backend rejects the call unless a
+  // SharedTextureMemoryVkImageLayoutEndState is chained (it writes the
+  // released VkImage layouts there), while the Metal backend only accepts its
+  // own optional end state. The returned fences are dropped: Dawn keeps the
+  // texture alive for in-flight GPU work on its own.
+  static void endAccess(const wgpu::SharedTextureMemory &memory,
+                        const wgpu::Texture &texture) {
+    wgpu::SharedTextureMemoryEndAccessState state{};
+#if defined(__ANDROID__)
+    wgpu::SharedTextureMemoryVkImageLayoutEndState vkLayout{};
+    state.nextInChain = &vkLayout;
+#endif
+    (void)memory.EndAccess(texture, &state);
+  }
+
 private:
   wgpu::ExternalTexture _instance;
   wgpu::SharedTextureMemory _memory;

package/cpp/rnwgpu/api/GPUFeatures.h

@@ -115,7 +115,8 @@ namespace rnwgpu {
   V(RenderPassRenderArea, "render-pass-render-area")                           \
   V(AdapterPropertiesDrm, "adapter-properties-drm")                            \
   V(TextureCompressionUnaligned, "texture-compression-unaligned")              \
-  V(DawnAllowUndefinedLoadStoreOp, "dawn-allow-undefined-load-store-op")
+  V(DawnAllowUndefinedLoadStoreOp, "dawn-allow-undefined-load-store-op")       \
+  V(BufferMapWriteExtendedUsages, "buffer-map-write-extended-usages")
 
 static void convertEnumToJSUnion(wgpu::FeatureName inEnum,
                                  std::string *outUnion) {

package/cpp/rnwgpu/api/GPUSharedTextureMemory.cpp

@@ -75,7 +75,7 @@ void GPUSharedTextureMemory::beginAccess(
 #endif
 
   auto status = _instance.BeginAccess(texture->get(), &desc);
-  if (!status) {
+  if (status != wgpu::Status::Success) {
     throw std::runtime_error("GPUSharedTextureMemory::beginAccess() failed");
   }
 }
@@ -101,7 +101,7 @@ jsi::Value GPUSharedTextureMemory::endAccess(jsi::Runtime &runtime,
 #endif
 
   auto status = _instance.EndAccess(texture->get(), &state);
-  if (!status) {
+  if (status != wgpu::Status::Success) {
     throw jsi::JSError(runtime, "GPUSharedTextureMemory::endAccess() failed");
   }
 

package/cpp/rnwgpu/api/descriptors/GPUDeviceDescriptor.h

@@ -29,6 +29,11 @@ struct GPUDeviceDescriptor {
   // Non-standard Dawn-only device toggles, chained onto the wgpu::Device
   // descriptor in GPUAdapter::requestDevice.
   std::optional<std::shared_ptr<GPUDawnTogglesDescriptor>> dawnToggles;
+  // Non-standard RN extension. Dawn's ImplicitDeviceSynchronization feature is
+  // requested by default so a single device can be used from several runtimes
+  // (JS thread + worklet runtimes). Set to false to opt out and get an
+  // unsynchronized (single-thread only) device.
+  std::optional<bool> implicitDeviceSynchronization;
 };
 
 } // namespace rnwgpu
@@ -108,6 +113,12 @@ template <> struct JSIConverter<std::shared_ptr<rnwgpu::GPUDeviceDescriptor>> {
             std::optional<std::shared_ptr<GPUDawnTogglesDescriptor>>>::fromJSI(
             runtime, prop, false);
       }
+      if (value.hasProperty(runtime, "implicitDeviceSynchronization")) {
+        auto prop =
+            value.getProperty(runtime, "implicitDeviceSynchronization");
+        result->implicitDeviceSynchronization =
+            JSIConverter<std::optional<bool>>::fromJSI(runtime, prop, false);
+      }
     }
 
     return result;