From d36d3eb0e2164d3bdec168f047f15b7925bd5f83 Mon Sep 17 00:00:00 2001
From: Zirro <code@zirro.se>
Date: Wed, 19 Dec 2018 21:52:23 +0100
Subject: [PATCH] Serialize the children of void elements as the empty string

Fixes #4220, by making the algorithm consistent with the current
implementations in Blink and WebKit, as well as the existing web
platform tests. Now, innerHTML of void elements returns the empty string
even in cases where child nodes are present.

Tests (preexisting): https://wpt.fyi/results/html/syntax/serializing-html-fragments/serializing.html
---
 source | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/source b/source
index 2008a4dab19..0ff2ef91afe 100644
--- a/source
+++ b/source
@@ -99953,7 +99953,6 @@ dictionary <dfn>StorageEventInit</dfn> : <span>EventInit</span> {
    <dd><code>area</code>, <code>base</code>, <code>br</code>, <code>col</code>, <code>embed</code>,
    <code>hr</code>, <code>img</code>, <code>input</code>, <code>link</code>, <code>meta</code>,
    <code>param</code>, <code>source</code>, <code>track</code>, <code>wbr</code></dd>
-   <!-- see also other places that say VOIDLIST -->
    <!-- non-conforming elements treated as void by the parser are not listed here: basefont,
    bgsound, frame, keygen -->
 
@@ -110567,6 +110566,10 @@ document.body.appendChild(text);
 
   <!--en-GB--><h3 id="serialising-html-fragments">Serializing HTML fragments</h3>
 
+  <p>For the purposes of the following algorithm, an element <dfn>serializes as void</dfn> if its
+  element type is one of the <span>void elements</span>, or is <code>basefont</code>,
+  <code>bgsound</code>, <code>frame</code>, or <code>keygen</code>.</p>
+
   <p>The following steps form the <!--en-GB--><dfn id="html-fragment-serialisation-algorithm"
   data-export="">HTML fragment serialization algorithm</dfn>. The algorithm takes as input a DOM
   <code>Element</code>, <code>Document</code>, or <code>DocumentFragment</code> referred to as
@@ -110577,6 +110580,9 @@ document.body.appendChild(text);
 
   <ol>
 
+   <li><p>If <var>the node</var> <span>serializes as void</span>, then return the empty
+   string.</p></li>
+
    <li><p>Let <var>s</var> be a string, and initialize it to the empty string.</p></li>
 
    <li><p>If <var>the node</var> is a <code>template</code> element, then let <var>the node</var> instead be the <code>template</code> element's <span>template
@@ -110681,15 +110687,8 @@ document.body.appendChild(text);
 
         <p>Append a U+003E GREATER-THAN SIGN character (&gt;).</p>
 
-        <p>If <var>current node</var> is an <code>area</code>, <code>base</code>,
-        <code>basefont</code>, <code>bgsound</code>, <code>br</code>, <code>col</code>,
-        <code>embed</code>, <code>frame</code>, <code>hr</code>, <code>img</code>,
-        <code>input</code>, <code>keygen</code>, <code>link</code>, <code>meta</code>,
-        <code>param</code>, <code>source</code>, <code>track</code> or <code>wbr</code> element,
-        then continue on to the next child node at this point.</p>
-        <!-- VOIDLIST superset -->
-        <!-- also, i guess: image, but we don't list it because we don't consider it an "element",
-        more a "macro", and thus we should never serialize it -->
+        <p>If <var>current node</var> <span>serializes as void</span>, then continue on to the next
+        child node at this point.</p>
 
         <p>Append the value of running the <span>HTML fragment serialization algorithm</span> on the
         <var>current node</var> element (thus recursing into this algorithm for that
@@ -110764,7 +110763,7 @@ document.body.appendChild(text);
 
    </li>
 
-   <li><p>The result of the algorithm is the string <var>s</var>.</p></li>
+   <li><p>Return <var>s</var>.</p></li>
 
   </ol>