Add BackupIncumbentScope to set incumbent realm

Incumbent realm was not designated for content attribute, so this CL
sets event target's realm to incumbent realm.

Bug: 893951
Change-Id: If7f526907dae803cd875d70ed79c9ee288df72a9
Reviewed-on: https://chromium-review.googlesource.com/c/1276406
Commit-Queue: Yuki Yamada <yukiy@google.com>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#598762}

third_party/blink/renderer/bindings/core/v8/js_event_handler.cc

@@ -25,6 +25,8 @@ void JSEventHandler::SetCompiledHandler(
     v8::Local<v8::Function> listener,
     const V8PrivateProperty::Symbol& property) {
   DCHECK(!HasCompiledHandler());
+  v8::Context::BackupIncumbentScope backup_incumbent_scope(
+      script_state->GetContext());
   event_handler_ = V8EventHandlerNonNull::Create(listener);
   Attach(script_state, listener, property, this);
 }