From 5d583f8478d0a4f626badc88d1523fa323f25632 Mon Sep 17 00:00:00 2001
From: Steven Obiajulu <steven@usejunior.com>
Date: Mon, 23 Feb 2026 22:31:19 -0500
Subject: [PATCH] Collapse range before mutations in deleteContents and extract

Move the step that sets the range's start and end to (newNode, newOffset)
from after DOM mutations to before them, in both the deleteContents()
and extract() algorithms.

The pre-computed collapse target can become invalid if script runs during
the remove operation (via "removing steps" hooks) and modifies the DOM.
By collapsing the range before mutations, the DOM's built-in live range
maintenance mechanisms (live range pre-remove steps and replace data
range adjustments) automatically keep the range valid through all
subsequent operations.

Fixes #1446.
---
 dom.bs | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/dom.bs b/dom.bs
index 5266d1bb..27b9f232 100644
--- a/dom.bs
+++ b/dom.bs
@@ -9283,6 +9283,17 @@ method steps are:
     point.
   </ol>
 
+ <li>
+  <p>Set <a>this</a>'s <a for=range>start</a> and <a for=range>end</a> to
+  (<var>newNode</var>, <var>newOffset</var>).
+
+  <p class=note>This is done before performing mutations, because the DOM's built-in
+  <a>live range</a> maintenance mechanisms
+  (<a>live range pre-remove steps</a> and <a>replace data</a> range adjustments)
+  will automatically keep the range valid through the subsequent operations. Collapsing the
+  range after mutations would be unreliable, since script can run during
+  <a for=/>removal</a> and modify the DOM.
+
  <li><p>If <var>originalStartNode</var> is a {{CharacterData}} <a for=/>node</a>, then
  <a>replace data</a> of <var>originalStartNode</var> with <var>originalStartOffset</var>,
  <var>originalStartNode</var>'s <a for=Node>length</a> &minus; <var>originalStartOffset</var>, and
@@ -9294,9 +9305,6 @@ method steps are:
  <li><p>If <var>originalEndNode</var> is a {{CharacterData}} <a for=/>node</a>, then
  <a>replace data</a> of <var>originalEndNode</var> with 0, <var>originalEndOffset</var>, and
  the empty string.
-
- <li><p>Set <a for=range>start</a> and <a for=range>end</a> to
- (<var>newNode</var>, <var>newOffset</var>).
 </ol>
 </div>
 
@@ -9414,8 +9422,16 @@ method steps are:
     point.
   </ol>
 
-  <!-- Now we start with mutations, so we can't refer to this anymore unless we carefully consider
-  how it will have mutated. -->
+ <li>
+  <p>Set <var>range</var>'s <a for=range>start</a> and <a for=range>end</a> to
+  (<var>newNode</var>, <var>newOffset</var>).
+
+  <p class=note>This is done before performing mutations, because the DOM's built-in
+  <a>live range</a> maintenance mechanisms
+  (<a>live range pre-remove steps</a> and <a>replace data</a> range adjustments)
+  will automatically keep the range valid through the subsequent operations. Collapsing the
+  range after mutations would be unreliable, since script can run during
+  <a for=/>removal</a> and modify the DOM.
 
  <li>
   <p>If <var>firstPartiallyContainedChild</var> is a {{CharacterData}} <a for=/>node</a>:
@@ -9498,9 +9514,6 @@ method steps are:
    <li><p><a>Append</a> <var>subfragment</var> to <var>clone</var>.
   </ol>
 
- <li><p>Set <var>range</var>'s <a for=range>start</a> and <a for=range>end</a> to
- (<var>newNode</var>, <var>newOffset</var>).
-
  <li><p>Return <var>fragment</var>.
 </ol>
 </div>
@@ -11284,6 +11297,7 @@ Simon Pieters,
 Simon Wülker,
 Stef Busking,
 Steve Byrne,
+Steven Obiajulu,
 Stig Halvorsen,
 Tab Atkins,
 Takashi Sakamoto,