IFrame load blocker could be incorrectly cleared

[jdm]

iframe_load_event_steps unconditionally terminates any load blocker that currently exists after the iframe's load event has been dispatched. If the load event handler ended up causing navigate_or_reload_child_browsing_context (by setting the src attribute, for example), this will terminate the replacement load blocker before the load is actually complete.

We should either be terminating the load blocker before dispatching the load event, or else checking that the element's pipeline ID matches before terminating it.

[nox]

I will look into this.