Event handlers on closed pipelines can trigger panics

[jdm]

This turns out to be a generalization of #16057 which I realized when thinking about whether #17323 was testable.

<iframe src="about:blank"></iframe>
<script>
  var i = document.querySelector('iframe');
  i.onload = function() {
    var e = i.contentDocument.body;
    e.onclick = function() { e.clientLeft };
    i.remove();
    setTimeout(function() { e.click() }, 0);
  }
</script>

[jdm]

When I run this test in Firefox, adding a console.log to the handler demonstrates that Firefox happily invokes the event handler. We may need to change how we implement Window::clear_js_runtime and the DOM APIs that query layout if they need to be able to work after a document no longer exists.