From 5d583f8478d0a4f626badc88d1523fa323f25632 Mon Sep 17 00:00:00 2001 From: Steven Obiajulu Date: Mon, 23 Feb 2026 22:31:19 -0500 Subject: [PATCH 1/3] Collapse range before mutations in deleteContents and extract Move the step that sets the range's start and end to (newNode, newOffset) from after DOM mutations to before them, in both the deleteContents() and extract() algorithms. The pre-computed collapse target can become invalid if script runs during the remove operation (via "removing steps" hooks) and modifies the DOM. By collapsing the range before mutations, the DOM's built-in live range maintenance mechanisms (live range pre-remove steps and replace data range adjustments) automatically keep the range valid through all subsequent operations. Fixes #1446. --- dom.bs | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/dom.bs b/dom.bs index 5266d1bbe..27b9f2323 100644 --- a/dom.bs +++ b/dom.bs @@ -9283,6 +9283,17 @@ method steps are: point. +
  • +

    Set this's start and end to + (newNode, newOffset). + +

    This is done before performing mutations, because the DOM's built-in + live range maintenance mechanisms + (live range pre-remove steps and replace data range adjustments) + will automatically keep the range valid through the subsequent operations. Collapsing the + range after mutations would be unreliable, since script can run during + removal and modify the DOM. +

  • If originalStartNode is a {{CharacterData}} node, then replace data of originalStartNode with originalStartOffset, originalStartNode's length − originalStartOffset, and @@ -9294,9 +9305,6 @@ method steps are:

  • If originalEndNode is a {{CharacterData}} node, then replace data of originalEndNode with 0, originalEndOffset, and the empty string. - -

  • Set start and end to - (newNode, newOffset). @@ -9414,8 +9422,16 @@ method steps are: point. - +

  • +

    Set range's start and end to + (newNode, newOffset). + +

    This is done before performing mutations, because the DOM's built-in + live range maintenance mechanisms + (live range pre-remove steps and replace data range adjustments) + will automatically keep the range valid through the subsequent operations. Collapsing the + range after mutations would be unreliable, since script can run during + removal and modify the DOM.

  • If firstPartiallyContainedChild is a {{CharacterData}} node: @@ -9498,9 +9514,6 @@ method steps are:

  • Append subfragment to clone. -

  • Set range's start and end to - (newNode, newOffset). -

  • Return fragment. @@ -11284,6 +11297,7 @@ Simon Pieters, Simon Wülker, Stef Busking, Steve Byrne, +Steven Obiajulu, Stig Halvorsen, Tab Atkins, Takashi Sakamoto, From 9956417c2e6796e68bed4fb19db297952f344eea Mon Sep 17 00:00:00 2001 From: Steven Obiajulu Date: Mon, 2 Mar 2026 12:45:42 -0500 Subject: [PATCH 2/3] Remove explanatory notes per reviewer feedback --- dom.bs | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/dom.bs b/dom.bs index 27b9f2323..4b80d205d 100644 --- a/dom.bs +++ b/dom.bs @@ -9287,13 +9287,6 @@ method steps are:

    Set this's start and end to (newNode, newOffset). -

    This is done before performing mutations, because the DOM's built-in - live range maintenance mechanisms - (live range pre-remove steps and replace data range adjustments) - will automatically keep the range valid through the subsequent operations. Collapsing the - range after mutations would be unreliable, since script can run during - removal and modify the DOM. -

  • If originalStartNode is a {{CharacterData}} node, then replace data of originalStartNode with originalStartOffset, originalStartNode's length − originalStartOffset, and @@ -9426,13 +9419,6 @@ method steps are:

    Set range's start and end to (newNode, newOffset). -

    This is done before performing mutations, because the DOM's built-in - live range maintenance mechanisms - (live range pre-remove steps and replace data range adjustments) - will automatically keep the range valid through the subsequent operations. Collapsing the - range after mutations would be unreliable, since script can run during - removal and modify the DOM. -

  • If firstPartiallyContainedChild is a {{CharacterData}} node: From 6c721d44788c3cd280b84da1580ad2f7b9efa32f Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Fri, 6 Mar 2026 10:31:51 +0100 Subject: [PATCH 3/3] formatting --- dom.bs | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/dom.bs b/dom.bs index 4b80d205d..7bf212a83 100644 --- a/dom.bs +++ b/dom.bs @@ -9283,9 +9283,8 @@ method steps are: point. -

  • -

    Set this's start and end to - (newNode, newOffset). +

  • Set this's start and end to + (newNode, newOffset).

  • If originalStartNode is a {{CharacterData}} node, then replace data of originalStartNode with originalStartOffset, @@ -9415,9 +9414,8 @@ method steps are: point. -

  • -

    Set range's start and end to - (newNode, newOffset). +

  • Set range's start and end to + (newNode, newOffset).

  • If firstPartiallyContainedChild is a {{CharacterData}} node: