Summary

serialize() documents that it "takes care of corner cases ... [and] consecutive identifiers that would otherwise parse back as the same token". It does this by inserting a /**/ comment between any adjacent pair of component values listed in BAD_PAIRS.

BAD_PAIRS is missing seven pairs from the CSS Syntax serialization table. When two such tokens end up adjacent — e.g. after a transform drops the whitespace between them, which is a routine operation — serialize() emits CSS that re-parses to a different token stream, silently changing the meaning of the input.

Reproduction

from tinycss2 import parse_component_value_list, serialize

tokens = parse_component_value_list('1 %')   # number, whitespace, '%' delim
del tokens[1]                                # drop the whitespace (e.g. a minifier)
print(serialize(tokens))                     # -> '1%'
print([t.type for t in parse_component_value_list('1%')])  # -> ['percentage']  (!!)

The two-token list [<number 1>, <delim %>] serializes to 1%, which parses back as a single percentage token.

Affected pairs

All are in the spec serialization table but were absent from BAD_PAIRS:

Root cause

A lone - delimiter merges after #/- (forming a hash or ident); a CDC (-->) merges after #/-/number/@ because its leading -- is consumed as hash / ident / dimension-unit / at-keyword characters; and a % delimiter merges into a preceding number to form a percentage. dimension+CDC and the number+ident/function/url pairs were already covered — these seven were the gap.

I derived the exact gap by transcribing the spec's 12-column serialization table and diffing it against BAD_PAIRS; the diff was precisely these seven pairs, and an exhaustive pairwise round-trip check over all token types flagged the same seven (and nothing else).

Fix

Add the seven missing pairs, mirroring the existing spec-table style already used in BAD_PAIRS (+9 lines in serializer.py, comment included).

Tests

New parametrized test_serialize_adjacent_tokens_do_not_merge (modeled on the existing test_backslash_delim): for each pair it parses the whitespace-separated source, deletes the whitespace token so the two component values are adjacent, serializes, re-parses, and asserts the token types and serializations are unchanged.

Proof the test guards the fix (stashing only the serializer.py change):

• without the fix: 9 failed
• with the fix: 9 passed
• full suite: 16984 passed (was 16975), no regressions
• ruff check clean on both changed files

Diff is +34 / -0 across tinycss2/serializer.py and tests/test_tinycss2.py.