x/pkgsite: duplicate escaping on error page

[findleyr]

Via @rsc, who encountered the following broken escaping on pkgsite:

Repro steps:

1. Visit https://pkg.go.dev/rsc.io/tmp/nonexist
2. Click "Fetch" button.
3. Wait for the load to fail.

[findleyr]

Interestingly, the test appears to look for this escaping explicitly:
https://cs.opensource.google/go/x/pkgsite/+/master:internal/frontend/fetchserver/fetch_test.go;l=170;drc=ebe617b30c52774fccf9d36331cbff31e99aaf9e

[findleyr]

Hmm, I don't know if/how this ever worked. Perhaps @jba recalls?

fetch.ts uses new DOMParser().parseFromString(...), but that doesn't unescape:

[hyangah]

I guess this was fixed just by updating the pkgsite backend... last week.

[findleyr]

Looks like this is still happening, reported by @mvdan

[mvdan]

Yes; I went to https://pkg.go.dev/golang.org/x/tools/internal/ast/cursor, I was presented with the "request docs for this package", and when I clicked it, I eventually loaded a page which looked like the original here - a bunch of HTML starting with a <div>. I did not take a screenshot, and the page now returns a correct 404 not found page, but I briefly shared my screen at today's tools call and I think that got recorded :)

[findleyr]

I'm guessing that the async fetch operations polls an endpoint, and eventually escapes the error content before formatting on screen.
And this doesn't happen if the error is rendered in the original page.