Previously discussed on #4294; please see there for discussion. Filing new issue to talk about canvas specifically, including non-destroy device loss too.

The key scenarios:

• Render, device loss, present
• Render, destroy, present
• Render, present, device loss
• Render, present, destroy

Some key points:

• Destroy impacts only a single device, whereas device loss is usually caused by something that impacts the whole GPU process and therefore would lose all of the canvases anyway
• Showing partial frames (due to device loss mid frame) is not good
• Some implementations may store the canvas data "inside" the device and so would need to copy it out in order to preserve it
• Destroy() is generally useful for cleaning things up, and it's reasonable to want to clean up when canvas rendering is done.
  • However various future conditions could cause that canvas's contents to be lost anyway, and in this case there would be no signal to re-render (since the device is already lost and it can't get another loss notification - we'd need some event on the canvas saying its contents were lost).

Overall I think this points toward both device loss and device destroy clearing the canvas, at the expense of key point 4. (This is a change and would necessitate changing some existing reftests.)