These two pieces of code behave observably differently in Chrome and Firefox (for reasons described inline):

s = document.createElement('input');
s.setAttribute('type', 'range'); // defaults min to 0 and max to 100; value is 50, the middle
s.setAttribute('min', '0'); // no change
s.setAttribute('max', '10'); // max is now < 50, so value is truncated to max, 10

s = document.createElement('input');
s.setAttribute('min', '0'); // min is 0
s.setAttribute('max', '10'); // max is 10
s.setAttribute('type', 'range'); // value is 5, mid-way between 0 and 10

I encountered this in Glimmer. We translate HTML syntax into DOM calls according to the HTML tree construction spec, but the spec assumes that an implementation can set all attributes simultaneously, which is not possible with today's APIs. We could special-case the type attribute for input and always make sure to set it last, but that's unfortunate (and who knows, there may be other issues, today or in the future, with another order).

It doesn't matter whether the attributes are set with the element with or without an owner document; the behavior is a consequence of the "suffering from an overflow" constraint.