Assuming that a text node has the data "fubar" and that the selection consists of the "ba" substring, then: replaceData(1, 1, "*") adds the "*" to the selection, although the "u" was not replaceData(3, 1, "*") removes the "*" from the selection, although the "a" was <bz> looks like a regression from bug 415860

Yeah. This is bug 415860 comment 15 and bug 415860 comment 17 mess, in spades. Basically, if we follow DOM spec there's no sane way to use ranges for selection in the presence of mutations. Is it worth maybe changing the behavior of just selection ranges to handle replaceData more sanely, by not following the DOM spec (e.g. by not modeling it as an insert/remove or by not treating the two endpoints identically)?

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046 Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5. If you have questions, please contact :mdaly.