diff --git a/source b/source
index a92d86863c1..14fc93d3f74 100644
--- a/source
+++ b/source
@@ -49831,6 +49831,11 @@ interface HTMLInputElement : HTMLElement {
to the value of the value content attribute, if there is
one, or the empty string otherwise, and then run the current value sanitization
algorithm, if one is defined.
If the element supports plain text ranges and this operation changes its + value, then the user agent must run the + plain text range full replacement steps with the element, the old value's + length, and the new value's length.
If the element supports plain text ranges and its + value has changed as a result of this algorithm, then the + user agent must run the plain text range full replacement steps with the element, the + old value's length, and the new value's length.
+Each input element can be mutable. Except where
otherwise specified, an input element is always mutable. Similarly, except where otherwise specified, the user
@@ -50087,6 +50097,10 @@ interface HTMLInputElement : HTMLElement {
element's text entry cursor position to the
beginning of the text control, and set its selection
direction to "none".
If previouslySelectable is true and nowSelectable is false, then for
+ each PlainTextRange object whose host is this element, set that object's host to
+ null and set both of its start and end offsets to 0.
type attributeInvoke the value sanitization algorithm, if the element's type attribute's current state defines one.
If the element's value is different from + oldValue, and the element supports plain text ranges, then run the + plain text range full replacement steps with the element, oldValue's + length, and the current value's + length.
If the element's value (after applying the value sanitization algorithm) is different from oldValue, and the element has a text entry cursor position, @@ -57529,6 +57548,9 @@ interface HTMLTextAreaElement : HTMLElement { interaction before queuing the task; for example, a user agent could wait for the user to have not hit a key for 100ms, so as to only fire the event when the user pauses, instead of continuously for each keystroke.
+Before queuing that task, if the element supports plain text ranges, then run the + plain text range value mutation steps with the element, the edit's offset, + deleted length, and inserted length to describe the change.
@@ -57549,7 +57571,11 @@ interface HTMLTextAreaElement : HTMLElement {The children changed steps for textarea elements must, if the
element's dirty value flag is false, set the element's
raw value to its child text
- content.
When a textarea element is popped off the stack of open elements of
@@ -57814,7 +57845,12 @@ interface HTMLTextAreaElement : HTMLElement {
The defaultValue attribute's setter must
- string replace all with the given value within this element.
Set this element's raw value to the new value.
Set this element's dirty value flag to - true.
Set this element's dirty value flag to true.
If this changes the element's API value, and the + element supports plain text ranges, then the user + agent must run the plain text range full replacement steps with this element, the + length of oldAPIValue, and the length of the element's new + API value.
If the new API value is different from
oldAPIValue, then move the text entry
@@ -62137,7 +62178,13 @@ MIT Room 32-G524
Let new length be the length of the value of the first
argument. Let new end be the sum of start and new length. Let new end be the sum of start and new length. Let deleted count be max(0, end minus start). If this element supports plain text ranges,
+ then run the plain text range value mutation algorithm
+ with this element, start, deleted count, and new length. Run the appropriate set of substeps from the following list: