I've also tested in Version 54.0.2815.0 canary (64-bit), and it's also broken.

Blink/WebKit fails while Gecko passes, not sure about spec.

 Issue 633075  has been merged into this issue.

Issue dupe of 633149 hence merging the same as info is provided in the bug.

hm I don't understand why this was merged into https://bugs.chromium.org/p/chromium/issues/detail?id=633149, which is a completely different bug (it is about date input element). This is about the range input element. Am I missing something?

Hey, apologies for the confusion, un-merging as per comment #5.

Thank you!

I think the specification doesn't define how to change the value on setting |step| attribute.  So, this behavior isn't wrong.  However, this is an interoperability issue.

The spec actually defines what should happen when the input suffers from step mismatch: 

-----------
When the element is suffering from a step mismatch, the user agent must round the element's value to the nearest number for which the element would not suffer from a step mismatch, and which is greater than or equal to the minimum, and, if the maximum is not less than the minimum, which is less than or equal to the maximum, if there is a number that matches these constraints. If two numbers match these constraints, then user agents must use the one nearest to positive infinity.
------------

https://www.w3.org/TR/html5/forms.html#range-state-(type=range)

Chrome also implements this partly, as you can see in the reproduction: the first time the step is changed (to 15), the value changes correctly, but not for the next time it is changed (to 20).

Please also note that issue https://bugs.chromium.org/p/chromium/issues/detail?id=633075 which was closed as a duplicate should be considered as an additional test case.

#8, you're right!  Thanks.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/14d43b4c79aeb380ef35fa9167ccd955fd1d32d1

commit 14d43b4c79aeb380ef35fa9167ccd955fd1d32d1
Author: tkent <tkent@chromium.org>
Date: Sat Sep 24 00:17:01 2016

input[type=range]: Updating step attribute should align the value to steps.

BUG= 633074 

Review-Url: https://codereview.chromium.org/2366753004
Cr-Commit-Position: refs/heads/master@{#420798}

[modify] https://crrev.com/14d43b4c79aeb380ef35fa9167ccd955fd1d32d1/third_party/WebKit/LayoutTests/fast/forms/range/ValidityState-stepMismatch-range-expected.txt
[modify] https://crrev.com/14d43b4c79aeb380ef35fa9167ccd955fd1d32d1/third_party/WebKit/LayoutTests/fast/forms/range/ValidityState-stepMismatch-range.html
[modify] https://crrev.com/14d43b4c79aeb380ef35fa9167ccd955fd1d32d1/third_party/WebKit/Source/core/html/forms/RangeInputType.cpp
[modify] https://crrev.com/14d43b4c79aeb380ef35fa9167ccd955fd1d32d1/third_party/WebKit/Source/core/html/forms/RangeInputType.h

oops, #420798 didn't fix this perfectly. Reopen.

There were two bugs.

A) Updating 'step' attribute didn't update the *dirty* value.
B) Updating 'step' attribute doesn't refer to the last value, but the default value if the value is not dirty.

#420798 fixed only A.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/930e066130dc8621d4b25c8bfe14d8fff315404e

commit 930e066130dc8621d4b25c8bfe14d8fff315404e
Author: tkent <tkent@chromium.org>
Date: Tue Sep 27 04:17:47 2016

Introduce HTMLInputElement::m_hasDirtyValue.

Add a bool flag to represent the dirty flag [1]. We replace
!m_valueIfDirty.isNull() for dirty flag checking with the new flag.

This CL has no behavior changes.  This CL is a preparation to make
m_valueIfDirty a permanent storage of |value| IDL attribute.

[1] https://html.spec.whatwg.org/multipage/forms.html#concept-input-value-dirty-flag
[2] https://html.spec.whatwg.org/multipage/forms.html#dom-input-value

BUG= 633074 

Review-Url: https://codereview.chromium.org/2368193002
Cr-Commit-Position: refs/heads/master@{#421100}

[modify] https://crrev.com/930e066130dc8621d4b25c8bfe14d8fff315404e/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
[modify] https://crrev.com/930e066130dc8621d4b25c8bfe14d8fff315404e/third_party/WebKit/Source/core/html/HTMLInputElement.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9763e857c8822745fb03e460e1bafdb638b95d71

commit 9763e857c8822745fb03e460e1bafdb638b95d71
Author: tkent <tkent@chromium.org>
Date: Mon Oct 31 07:18:03 2016

INPUT element: Updating 'step' attribute should adjust the last value.

Bug:
If
 - 'step' attribute is updated,
 - we adjust the value, and
 - the value is not dirty,
we adjusted the default value instead of the last value.

Implementation:
We didn't store the last value if the value is not dirty, and compute the value
on the fly.
With this CL, we always store the current value to
HTMLInputElement::m_valueIfDirty though we stored only a dirty value.
 * When |value| attribute is updated, we update m_valueIfDirty as well.
 * Remove special handling of null m_valueIfDirty
  Because setValue(null0string) doesn't clear hasDirtyValue() flag, this CL
  introduces setNonDirtyValue() like HTMLTextAreaElement::setNonDirtyValue().
 * Make HTMLInputElement::value() clearer.

BUG= 633074 

Review-Url: https://codereview.chromium.org/2463693002
Cr-Commit-Position: refs/heads/master@{#428663}

[modify] https://crrev.com/9763e857c8822745fb03e460e1bafdb638b95d71/third_party/WebKit/LayoutTests/fast/forms/range/range-set-attribute-expected.txt
[modify] https://crrev.com/9763e857c8822745fb03e460e1bafdb638b95d71/third_party/WebKit/LayoutTests/fast/forms/range/range-set-attribute.html
[modify] https://crrev.com/9763e857c8822745fb03e460e1bafdb638b95d71/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
[modify] https://crrev.com/9763e857c8822745fb03e460e1bafdb638b95d71/third_party/WebKit/Source/core/html/HTMLInputElement.h
[modify] https://crrev.com/9763e857c8822745fb03e460e1bafdb638b95d71/third_party/WebKit/Source/core/html/forms/InputType.h
[modify] https://crrev.com/9763e857c8822745fb03e460e1bafdb638b95d71/third_party/WebKit/Source/core/html/forms/RangeInputType.cpp
[modify] https://crrev.com/9763e857c8822745fb03e460e1bafdb638b95d71/third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp