This was reported by Edge team. Thanks.

Test cases provided by Edge team except for "http://a a/" will be covered by this fix: https://codereview.chromium.org/2297483002/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4

commit a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4
Author: tyoshino <tyoshino@chromium.org>
Date: Thu Sep 01 11:37:12 2016

Make XMLHttpRequest.open() throw for invalid URLs

Also adds tests for invalid/forbidden methods.

R=yhirano@chromium.org
BUG= 642239 

Review-Url: https://codereview.chromium.org/2297483002
Cr-Commit-Position: refs/heads/master@{#415932}

[add] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/LayoutTests/fast/xmlhttprequest/invalid-method.html
[add] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/LayoutTests/fast/xmlhttprequest/invalid-url.html
[modify] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-invalid-values-expected.txt
[modify] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-invalid-values.html
[modify] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/cross-origin-unsupported-url-expected.txt
[add] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/open-with-invalid-argument-is-noop.html
[modify] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/resources/cross-origin-unsupported-url.js
[modify] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/cross-origin-unsupported-url-expected.txt
[modify] https://crrev.com/a0bab936d014e4c74e7d8bfcdb7be5a74b69c6a4/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

Fixed except for the case in the comment 2. The fix also made XHR conform to the spec in terms of that open() with invalid arguments are no-op. I.e.:
  xhr.open(good args);
  try {
    xhr.open(bad args);
  } catch (e) {
  }
  xhr.send();

This send() proceeds with the good args.

This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I think our remaining problems are just the usual compat issues in our URL parsing. We have plenty of other bugs filed about those. So I'm marking this one as fixed.