Notify the deleted cookie on change

src/browser/tests/cookie_store.html

@@ -114,6 +114,32 @@
   });
 </script>
 
+<script id=change-event-delete-reports-removed-value>
+  testing.async(async () => {
+    const events = [];
+    const handler = (e) => events.push(e);
+    cookieStore.addEventListener('change', handler);
+
+    await cookieStore.set('ev-delete-val', 'original');
+    await new Promise(r => setTimeout(r, 0));
+
+    // Sanity: the change event must report the value that was stored.
+    testing.expectEqual('original', events[0].changed[0].value);
+
+    await cookieStore.delete('ev-delete-val');
+    await new Promise(r => setTimeout(r, 0));
+
+    // The deleted CookieListItem should describe the cookie that was
+    // removed, so its value must be what the jar held ("original") —
+    // not the deletion payload's value ("").
+    testing.expectEqual(1, events[1].deleted.length);
+    testing.expectEqual('ev-delete-val', events[1].deleted[0].name);
+    testing.expectEqual('original', events[1].deleted[0].value);
+
+    cookieStore.removeEventListener('change', handler);
+  });
+</script>
+
 <script id=change-event-from-document-cookie>
   testing.async(async () => {
     const events = [];

src/browser/webapi/storage/Cookie.zig

@@ -509,11 +509,18 @@ pub const Jar = struct {
                 return;
             }
 
-            c.deinit();
             if (is_expired) {
+                // Dispatch while c still points at the live old cookie,
+                // then free its arena, then remove from the array. After
+                // swapRemove, items[i] holds a different (still-live)
+                // entry, so deinit must happen before that.
+                self.dispatchChange(.deleted, c);
+                c.deinit();
                 _ = self.cookies.swapRemove(i);
-                self.dispatchChange(.deleted, &cookie);
             } else {
+                // Free the old cookie's arena before overwriting the slot;
+                // after the assignment, c points at the new cookie.
+                c.deinit();
                 self.cookies.items[i] = cookie;
                 self.dispatchChange(.changed, &self.cookies.items[i]);
             }