UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Steps to reproduce the problem:
1. Open up the Javascript console (Ctrl+Shift+J)

2. Enter the following commands:

  blah = document.createElement("blah");
  blah.innerHTML = `<one/><two/><three/>`;
  blah.outerHTML;

3. Actual results: See output on final command as

  "<blah><one><two><three></three></two></one></blah>"

What is the expected behavior?
Expected results:

  "<blah><one/><two/><three/></blah>"

These results would also be acceptable:

  "<blah><one></one><two></two><three></three></blah>"

What went wrong?
When assigning innerHTML, empty elements (elements that close themselves rather than having a separate closing tag, e.g. `<x/>` vs <x></x>`) are assumed to not be empty, resulting in improper nesting.

Did this work before? No 

Chrome version: 63.0.3239.84  Channel: n/a
OS Version: Debian Chromium
Flash Version: 

There must be something special about <br> and <img> because this works:

  blah = document.createElement("blah");
  blah.innerHTML=`<img/><img><br/>`;
  blah.outerHTML;

-> "<blah><img><img><br></blah>"

(I expected "<blah><img/><img>/><br/></blah>" but this does reinforce the internal knowledge about *specific* empty elements, which I assume should help parsing when missing the trailing slash.)