Added comments. Basically, a legal range can start at (parent, parent.childNodes.length), and I can find nothing anywhere promising me that Range.setStartBefore will never return this position.