Master-Master on a VIP with a multiple Slave
Do not connect a Slave to a pair of Masters via a VIP.

There is nothing to keep the binlogs synced up, so a Slave must communicate with only one Master.  (Multi-source Slave is a different topic.)

You could, however, have half your slaves connected to one Master, and half to the other.  Then if either Master goes down, you lose only half the Slaves.

If you are trying to limit the configuration to only 3 servers, then consider Galera (in PXC or MariaDB).  It has a lot more advantages than M&lt;->M->S.

Even with multiple Slaves, consider Galera with 3 nodes, then evenly distribute the slaves off the Cluster nodes.  Now a single Master failure will lead to losing only 1/3 of the Slaves.

(Actually, you don't lose the Slaves of a dead Master, but they do get stale.)