Regression fix: tokenize features earlier in window.open()

Regressed in a68a1f7.

Fixes #3107.

source

@@ -78180,6 +78180,9 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
    <li><p>If <var>target</var> is the empty string, then set <var>target</var> to "<code
    data-x="">_blank</code>".</p></li>
 
+   <li><p>Let <var>tokenizedFeatures</var> be the result of <span
+   data-x="concept-window-open-features-tokenize">tokenizing</span> <var>features</var>.</p></li>
+
    <li><p>Let <var>noopener</var> be true if <var>tokenizedFeatures</var> <span data-x="map
    exists">contains</span> an entry with the key "<code data-x="">noopener</code>"</p></li>
 
@@ -78198,9 +78201,6 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
 
    <li><p>If <var>target browsing context</var> is null, then return null.</p></li>
 
-   <li><p>Let <var>tokenizedFeatures</var> be the result of <span
-   data-x="concept-window-open-features-tokenize">tokenizing</span> <var>features</var>.</p></li>
-
    <li><p>Let <var>resource</var> be the <span>URL</span> "<code>about:blank</code>".</p></li>
 
    <li>