Clarify selection behaviour of setting textarea value via property

The behavior of the selection inside of an textarea element when changing a value is currently unclear, or at least not clearly defined in the spec.

Consider this example:

const t = document.createElement("textarea");
t.defaultValue = "foobar";  // same for .textContent
t.selectionStart = 1;
t.selectionEnd = 5;
console.log(`start: ${t.selectionStart}, end: ${t.selectionEnd}`);
t.defaultValue = "foo";
console.log(`start: ${t.selectionStart}, end: ${t.selectionEnd}`);

According to the spec, the selection should be adjusted to the new length when the "relevant value" changes, therefore the expected output would be this (at least how I would interpret this, and how it is currently implemented in Firefox):

start: 1, end: 5
start: 1, end: 3

However, in this case changing the value is a replace operation. As per DOM Spec, all child nodes are removed first, which would collapse the selection to 0, then the new content is added:

start: 1, end: 5
start: 0, end: 0

The web-platform tests for this enforce that the selection is collapsed to 0 (so the procedure mentioned in the DOM spec takes precedence), which is what other browsers have implemented as well. This contradicts what happens in an input element, where the former result would be expected.

It would be great if this behaviour would be defined in the spec in a more precise way - regardless of which result is desired here; IMO both outcomes are somewhat explainable.

CC @zcorpan @masayuki-nakano

Start by reading the linked HTML Standard text-field selection section and the DOM Standard replace-all algorithm, then inspect the referenced web-platform test at selection-start-end-extra.html. Done means resolving which selection behavior applies when a textarea's defaultValue or textContent changes and defining the behavior precisely in the HTML Standard, with the test expectation aligned.