NEW308549
Range.deleteContents() and extractContents() collapse range after mutations, can produce invalid position 
https://bugs.webkit.org/show_bug.cgi?id=308549
Summary Range.deleteContents() and extractContents() collapse range after mutations, ...
steven
Reported 2026-02-24 06:08:46 PST
`Range.deleteContents()` and the `extract` algorithm compute the collapse target `(newNode, newOffset)` before mutations but apply it after all DOM mutations complete. Script running during `remove` (via "removing steps" hooks) could modify the DOM and make those pre-computed values point to an invalid position. The DOM spec is being fixed to move the collapse step before mutations, relying on the built-in `live range pre-remove steps` and `replace data` range adjustments to maintain validity. Steps to reproduce: 1. Create a Range spanning multiple child nodes of a container element 2. Call range.deleteContents() or range.extractContents() 3. Inspect the range's startContainer, startOffset, endContainer, endOffset All current browsers pass the attached conformance tests today because no removing step currently fires synchronous script, but the code path is latently incorrect. Spec issue: https://github.com/whatwg/dom/issues/1446 Chromium bug: https://issues.chromium.org/issues/486922855 Gecko bug: https://bugzilla.mozilla.org/show_bug.cgi?id=2018839
Attachments
Conformance test verifying Range collapse position after deleteContents/extractContents (9.00 KB, text/html)
2026-02-24 06:13 PST, steven 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
steven
Comment 1 2026-02-24 06:13:26 PST
Created attachment 478460 [details] Conformance test verifying Range collapse position after deleteContents/extractContents
Note You need to log in before you can comment on or make changes to this bug.