UISaveState is included in htmlTag param map

<t:div>
<t:saveState .../>

</t:div>

<saveState> are included as <f:param> for htmlTagRender.

HtmlComponentUtils.java

public static Map getParameterMap(UIComponent component) {
Map result = new HashMap();
for (Iterator iter = component.getChildren().iterator(); iter.hasNext() {
UIComponent child = (UIComponent) iter.next();
if (child instanceof UIParameter) {
UIParameter uiparam = (UIParameter) child;
Object value = uiparam.getValue();
if (value != null)

{ result.put(uiparam.getName(), value); }

}
}
return result;
}

---------fix:---------------
parameterMap is for <f:param> only.

so change the following:
if (child instanceof UIParameter) --> if (child.getClass().equals(UIParameter.class))