De-flake image-loading-subpixel-clip.html

If the image is in cache, then the onload handler could happen
synchronously before the script had a time to add the handler.

The fix is to set the src after the onload handler has been registered.

Change-Id: I8586119c5b36f033f36a594cd021230cb8a2bb8e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2119634Reviewed-by: Stefan Zager <szager@chromium.org>
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#753318}

third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-img-element/image-loading-subpixel-clip-ref.html

@@ -12,10 +12,11 @@
   </head>
   <div style="height: 44.5px"></div>
   <div style="position: relative; font-size: 0; background: lightblue">
-    <img id=target loading="lazy" data-sizes="auto" src="resources/image.png">
+    <img id=target loading="lazy" data-sizes="auto">
   </div>
 </html>
 <script src="/common/reftest-wait.js"></script>
 <script>
   target.onload = takeScreenshot;
+  target.src = "resources/image.png";
 </script>

third_party/blink/web_tests/external/wpt/html/semantics/embedded-content/the-img-element/image-loading-subpixel-clip.html

@@ -14,11 +14,12 @@
   <div style="height: 44.5px"></div>
   <div style="overflow: hidden">
     <div style="position: relative; font-size: 0; background: lightblue">
-      <img id=target loading="lazy" data-sizes="auto" src="resources/image.png">
+      <img id=target loading="lazy" data-sizes="auto">
     </div>
   </div>
 </html>
 <script src="/common/reftest-wait.js"></script>
 <script>
   target.onload = takeScreenshot;
+  target.src = "resources/image.png";
 </script>