Thanks for the test file.

Able to reproduce the issue on the latest canary(60.0.3096.0) using canary-xhr-bug.html file on Windows-10, Mac OS 10.12.4 and Linux Ubuntu 14.04.

Regressed in M-60:

Last good build: 60.0.3083.0
First bad build: 60.0.3084.0

Changelog:
==========
https://chromium.googlesource.com/chromium/src/+log/f95d508c15009e62252c38701982042740289d84..716a136332fbd8efc12a3892b6ae2a6c0be94ba7

Nate@: Could you please take a look at this.

Thank you!

@Nate -

https://chromium.googlesource.com/chromium/src/+/716a136332fbd8efc12a3892b6ae2a6c0be94ba7%5E%21/#F14
ImplicitClose() was replaced with CheckCompleted()

(CheckCompleted() sounds like a detection, rather than an action, though I see this is not the case, the name is misleading to me)

CheckCompleted() probably bails early somewhere -
+void Document::CheckCompleted() {
+  if (!ShouldComplete())
+    return;
+  if (frame_) {
+    frame_->Client()->RunScriptsAtDocumentIdle();
+
+    // Injected scripts may have disconnected this frame.
+    if (!frame_)
+      return;
+
+    // Check again, because runScriptsAtDocumentIdle() may have delayed the load
+    // event.
+    if (!ShouldComplete())
+      return;
+  }
+
+  // OK, completed. Fire load completion events as needed.
+  SetReadyState(kComplete);
+  if (LoadEventStillNeeded())
+    ImplicitClose();

 Issue 721523  has been merged into this issue.

Thanks for the great test case, kwkbtr! That made life a lot easier.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/25fa842cb11198a37ed0ae14a9618e20d2f97a02

commit 25fa842cb11198a37ed0ae14a9618e20d2f97a02
Author: japhet <japhet@chromium.org>
Date: Mon May 22 21:23:08 2017

Style tag in an XHR's responseXML shouldn't make the responseXML be null.

XMLHTTPRequest::response_document_ gets incorrectly cleared because
Document::well_formed_ is incorrectly false. This is because
well_formed_ is initialized in Document::ImplicitClose().
XMLHttpRequest used to call ImplicitClose() directly, but I changed
it to call Document::CheckCompleted() (which may then call
ImplicitClose) in
https://chromium.googlesource.com/chromium/src/+/716a136332fbd8efc12a3892b6ae2a6c0be94ba7

I had thought that CheckCompleted() would always call ImplicitClose()
for an XHR response document, but it's possible for CheckCompleted()
to early-exit because the document is not complete if a style element
has blocked load completion and won't un-block it until a timer is
fired.

There's no reason to wait until ImplicitClose() to set the well-formed
bit, though. Document::FinishedParsing() is sufficient, and setting it
there removes the need for XMLHttpRequest to manually call
CheckCompleted().

BUG= 721225 
TEST=http/tests/xmlhttprequest/style-tag-in-responseXML.html

Review-Url: https://codereview.chromium.org/2885633002
Cr-Commit-Position: refs/heads/master@{#473701}

[add] https://crrev.com/25fa842cb11198a37ed0ae14a9618e20d2f97a02/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/resources/xml-with-style-tag.xml
[add] https://crrev.com/25fa842cb11198a37ed0ae14a9618e20d2f97a02/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/style-tag-in-responseXML.html
[modify] https://crrev.com/25fa842cb11198a37ed0ae14a9618e20d2f97a02/third_party/WebKit/Source/core/dom/Document.cpp
[modify] https://crrev.com/25fa842cb11198a37ed0ae14a9618e20d2f97a02/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

This should be resolved in tomorrow's canary.