Currently, the set of surface references from a CompositorFrame includes both primary and fallback SurfaceDrawQuads.

This is perhaps a mistake. Consider the parent P, referencing the child C.

P1(C1, C2) means parent P submits a CompositorFrame P1 that references the child C where the first param is the fallback surface ID (C1), and the second is the primary surface ID (C2)

C1 is the fallback which means the display compositor already knows about it. C2 is not known yet. Today what we'll do is create a surface reference to a thing that does not yet exist.

Today, when the surface ID C2 becomes available we do not create a temporary reference for it because it is already referenced by the parent in a previous CompositorFrame.

Suppose that immediately after C2 activates (and SurfaceManager does not give it a temp reference), the parent submits P2(C1, C3).

Notice that P2 no longer refers to C2. Thus, it may get garbage collected before the parent finds out about it through "OnWindowSurfaceChanged" in Aura-Mus.

P2(C2, C3) thus, has an invalid fallback surface. If we hit a deadline, and C3 has not resolved, then we will fallback to a surface that no longer exists and we white flashing :-(

I think maybe a simple fix here is not not add "primary SurfaceDrawQuads" to the "embedded_clients" vector in CompositorFrameMetadata. We should only add fallback SurfaceDrawQuads to embedded_clients.

One way to think about this is primary SurfaceInfos are "requests" for synchronization, and fallback SurfaceInfos are "real references".

If the primary Surface is available by the time the parent embeds, then it'll eventually become the fallback Surface and all is good. WDYT?