Failed to write EL expression in onclick attribute of h: button tag

--Environment - CentOS Linux release 7.8.2003 (Core) - Eclipse IDE for Enterprise Java Developers.Version: 2020-03 (4.15.0) - openjdk version "11.0.7" 2020-04-14 LTS - JSF 2.3.9

Event: When the page is displayed, the HTTPS status is 500.

Eclipse console log

2020-08-10T15:17:17.299+0900|warning: StandardWrapperValve[Faces Servlet]: Servlet.service() for servlet Faces Servlet threw exception
javax.faces.application.ViewExpiredException: viewId:/base.jsf -View/base.Could not restore jsf.
    at com.sun.faces.lifecycle.RestoreViewPhase.execute(RestoreViewPhase.java:194)
    at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:76)
    at com.sun.faces.lifecycle.RestoreViewPhase.doPhase(RestoreViewPhase.java:109)
    at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:177)
    at javax.faces.webapp.FacesServlet.executeLifecyle(FacesServlet.java:707)
...abridgement...

Cause: Because the EL expression is written in the onclick attribute of the h: button tag

base.xml

...abridgement...
<h:button value="upload" onclick="#{uploadBean.onClick}"/>
...abridgement...

UploadBean.java

...abridgement...
/**
 *Get the JavaScript code to output for the onClick attribute.
 * @return JavaScript code.
 */
public String getOnClick() {
    StringBuilder builder = new StringBuilder();
    builder.append("window.open('upload.jsf");
    // ...abridgement...
    return builder.toString();
}
...abridgement...

I'm not sure why writing an EL expression doesn't work ... maybe because I'm not sure what the documentation says? I want someone to explain it in an easy-to-understand manner ...

The entire target URL string must be processed by a call to the encodeResourceURL() method of the ExternalContext. The name of the UIParameter goes on the left hand side, and the value of the UIParameter on the right hand side. The name and the value must be URLEncoded. Each UIParameter instance is separeted by an ampersand, as dictated in the URL spec. The final encoded result will be written out to the onclick attribute of the button as "window.location.href = ''". If the developer has specified a custom onlclick the window.location.href name/value pair will be appended at the end of the developer specified script. button(JSF 2.1 View Declaration Language: Facelets Variant)

(Rough translation) The target URL must be processed by calling the encodeResourceURL method of ExternalContext. The name of the UIParameter is displayed on the left and the value of the UIParameter is displayed on the right. The name and value must be URLE Encoded. Each UIParameter instance is separated by an ampersand according to the instructions in the URL specification. The final encoded result will be written to the button's onclick attribute as "window.location.href =''". If the developer specifies onlclick, the name-value pair for window.location.href will be added to the end of the script.

Correspondence: Change to type = "button" of input tag

base.xml

...abridgement...
<input type="button" value="upload" onclick="#{uploadBean.onClick}" />
...abridgement...

Question: Sometimes it works well to write an EL expression in the onclick attribute of the h: button tag

upload.xml

<h:button value="OK" onclick="submit('#{uploadBean.key}');" />

UploadBean.java

...abridgement...
    public String getKey() {
        return "formId:file";
    }
...abridgement...

output

<input type="button" onclick="submit('formId:file');window.location.href='/tryJsf/upload.jsf'; return false;" value="OK">