fix crash in window.open()

Fix #2485