Clamp selection and text entry cursor position on value changes

Fixes #2424. Fixes #2411. Fixes #3468.

source

@@ -54750,6 +54750,43 @@ MIT Room 32-G524
    data-x="">replacedB</code>".</p>
   </div>
 
+  <p>Whenever the <span data-x="concept-textarea/input-relevant-value">relevant value</span> changes
+  for an element to which these APIs apply, run these steps:</p>
+
+  <ol>
+   <li>
+    <p>If the element has a <span data-x="concept-textarea/input-selection">selection</span>:</p>
+
+    <ol>
+     <li><p>If the start of the selection is now past the end of the <span
+     data-x="concept-textarea/input-relevant-value">relevant value</span>, set it to the end of the
+     <span data-x="concept-textarea/input-relevant-value">relevant value</span>.</p></li>
+
+     <li><p>If the end of the selection is now past the end of the <span
+     data-x="concept-textarea/input-relevant-value">relevant value</span>, set it to the end of the
+     <span data-x="concept-textarea/input-relevant-value">relevant value</span>.</p></li>
+
+     <li><p>If the user agent does not support empty selection, and both the start and end of the
+     selection are now pointing to the end of the <span
+     data-x="concept-textarea/input-relevant-value">relevant value</span>, then instead set the
+     element's <span data-x="concept-textarea/input-cursor">text entry cursor position</span> to the
+     end of the <span data-x="concept-textarea/input-relevant-value">relevant value</span>, removing
+     any selection.</p></li>
+    </ol>
+   </li>
+
+   <li><p>Otherwise, the element must have a <span data-x="concept-textarea/input-cursor">text entry
+   cursor position</span> position. If it is now past the end of the <span
+   data-x="concept-textarea/input-relevant-value">relevant value</span>, set it to the end of the
+   <span data-x="concept-textarea/input-relevant-value">relevant value</span>.</p></li>
+  </ol>
+
+  <p class="note">In some cases where the <span
+  data-x="concept-textarea/input-relevant-value">relevant value</span> changes, other parts of the
+  specification will also modify the <span data-x="concept-textarea/input-cursor">text entry cursor
+  position</span>, beyond just the clamping steps above. For example, see the <code
+  data-x="dom-textarea-value">value</code> setter for <code>textarea</code>.</p>
+
   <p>Characters with no visible rendering, such as U+200D ZERO WIDTH JOINER, still count as
   characters. Thus, for instance, the selection can include just an invisible character, and the
   text insertion cursor can be placed to one side or another of such a character.</p>