This sounds like an Engine bug, not Client, from the description.

I happened across this bug today.  Looks like we're hitting a NOTREACHED() in NavigationControllerImpl::GoToIndex:

https://chromium.googlesource.com/chromium/src/+/8a956ecdb3d8794d1ddb0a4003e818bfbd19ebef/content/browser/frame_host/navigation_controller_impl.cc#593



Here's an engine stack trace and stderr log:

Thread 0 CRASHED [SIGABRT @ 0x000003e8000040db ]
0x00007f2e8d769cc9	(libc-2.19.so -raise.c:56 )	raise
0x00007f2e8d76d0d7	(libc-2.19.so -abort.c:89 )	abort
0x03a1fb31	(blimp_engine_app + 0x0361fb31 )	base::debug::BreakDebugger()
0x03a34007	(blimp_engine_app + 0x03634007 )	logging::LogMessage::~LogMessage()
0x012cfe53	(blimp_engine_app + 0x00ecfe53 )	content::NavigationControllerImpl::GoToIndex(int)
0x03a0cd3d	(blimp_engine_app + 0x0360cd3d )	blimp::engine::BlimpEngineSession::GoBack(int)
0x03a0d71e	(blimp_engine_app + 0x0360d71e )	blimp::engine::BlimpEngineSession::ProcessMessage(std::unique_ptr<blimp::BlimpMessage, std::default_delete<blimp::BlimpMessage> >, base::Callback<void (int), (base::internal::CopyMode)1> const&)
0x0041bb49	(blimp_engine_app + 0x0001bb49 )	blimp::(anonymous namespace)::DispatchProcessMessage(base::WeakPtr<blimp::BlimpMessageThreadPipe>, std::unique_ptr<blimp::BlimpMessage, std::default_delete<blimp::BlimpMessage> >, base::Callback<void (int), (base::internal::CopyMode)1> const&)
0x0041bd9a	(blimp_engine_app + 0x0001bd9a )	_ZN4base8internal7InvokerINS_13IndexSequenceIJLm0ELm1ELm2EEEENS0_9BindStateINS0_15RunnableAdapterIPFvNS_7WeakPtrIN5blimp22BlimpMessageThreadPipeEEESt10unique_ptrINS7_12BlimpMessageESt14default_deleteISB_EERKNS_8CallbackIFviELNS0_8CopyModeE1EEEEEESL_JRS9_NS0_13PassedWrapperISE_EERSI_EEENS0_12InvokeHelperILb0EvSN_EEFvvEE3RunEPNS0_13BindStateBaseE
0x03a1fd78	(blimp_engine_app + 0x0361fd78 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&)
0x03a3ab64	(blimp_engine_app + 0x0363ab64 )	base::MessageLoop::RunTask(base::PendingTask const&)
0x03a3ae77	(blimp_engine_app + 0x0363ae77 )	base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&)
0x03a3b19a	(blimp_engine_app + 0x0363b19a )	base::MessageLoop::DoWork()
0x03a3d928	(blimp_engine_app + 0x0363d928 )	base::MessagePumpLibevent::Run(base::MessagePump::Delegate*)
0x03a3a690	(blimp_engine_app + 0x0363a690 )	base::MessageLoop::RunHandler()
0x03a57e2f	(blimp_engine_app + 0x03657e2f )	base::RunLoop::Run()
0x0122bc27	(blimp_engine_app + 0x00e2bc27 )	content::BrowserMainLoop::MainMessageLoopRun()
0x0122ba04	(blimp_engine_app + 0x00e2ba04 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x0122e517	(blimp_engine_app + 0x00e2e517 )	content::BrowserMainRunnerImpl::Run()
0x012272cb	(blimp_engine_app + 0x00e272cb )	content::BrowserMain(content::MainFunctionParams const&)
0x03a13eca	(blimp_engine_app + 0x03613eca )	content::RunNamedProcessTypeMain(std::string const&, content::MainFunctionParams const&, content::ContentMainDelegate*)
0x03a148e2	(blimp_engine_app + 0x036148e2 )	content::ContentMainRunnerImpl::Run()
0x03a1329f	(blimp_engine_app + 0x0361329f )	content::ContentMain(content::ContentMainParams const&)
0x00415daa	(blimp_engine_app + 0x00015daa )	main
0x00007f2e8d754ec4	(libc-2.19.so -libc-start.c:287 )	__libc_start_main
0x00415c98	(blimp_engine_app + 0x00015c98 )	_start
0x00007ffc4916efff		
0x00007f2e8fc5efff		
0x00415c6f	(blimp_engine_app + 0x00015c6f )	__cxx_global_array_dtor
0x000003e7		


<previous log entries omitted>
[1:1:0601/152056:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152056:VERBOSE1:remote_channel_main.cc(164)] Sending BeginMainFrameAborted message to client with reason: CommitEarlyOutReason::ABORTED_DEFERRED_COMMIT
[1:1:0601/152056:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 0 to client.
[1:1:0601/152056:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152056:VERBOSE1:remote_channel_main.cc(183)] Sending commit message to client. Commit bytes size: 193030
[16603:16603:0601/152056:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[16603:16603:0601/152057:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[1:1:0601/152057:VERBOSE1:remote_channel_main.cc(146)] Sending commit request to client.
[1:1:0601/152057:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 1 to client.
[1:1:0601/152057:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152057:VERBOSE1:remote_channel_main.cc(164)] Sending BeginMainFrameAborted message to client with reason: CommitEarlyOutReason::ABORTED_DEFERRED_COMMIT
[1:1:0601/152057:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 0 to client.
[16603:16603:0601/152057:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[1:1:0601/152057:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152057:VERBOSE1:remote_channel_main.cc(183)] Sending commit message to client. Commit bytes size: 31280
[16603:16603:0601/152058:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[1:1:0601/152058:VERBOSE1:remote_channel_main.cc(146)] Sending commit request to client.
[1:1:0601/152058:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 1 to client.
[1:1:0601/152058:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152058:VERBOSE1:remote_channel_main.cc(164)] Sending BeginMainFrameAborted message to client with reason: CommitEarlyOutReason::ABORTED_DEFERRED_COMMIT
[1:1:0601/152058:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 0 to client.
[1:1:0601/152059:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152059:VERBOSE1:remote_channel_main.cc(146)] Sending commit request to client.
[1:1:0601/152059:VERBOSE1:remote_channel_main.cc(183)] Sending commit message to client. Commit bytes size: 23812
[1:1:0601/152059:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152059:VERBOSE1:remote_channel_main.cc(183)] Sending commit message to client. Commit bytes size: 103645
[1:1:0601/152059:VERBOSE1:remote_channel_main.cc(146)] Sending commit request to client.
[16603:16603:0601/152100:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[16603:16603:0601/152100:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[1:1:0601/152100:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 1 to client.
[1:1:0601/152100:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 0 to client.
[16603:16603:0601/152100:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[16603:16603:0601/152101:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[16603:16603:0601/152101:INFO:CONSOLE(307)] "Powered by AMP ⚡ HTML – Version 1464393900473", source: https://cdn.ampproject.org/rtv/001464393900473/v0.js (307)
[16603:16603:0601/152101:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[16603:16603:0601/152101:INFO:CONSOLE(58)] "<link rel=preload> must have a valid `as` value", source: https://cdn.ampproject.org/rtv/001464393900473/v0.js (58)
[16603:16603:0601/152101:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[16603:16603:0601/152101:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[16603:16614:0601/152101:ERROR:zygote_host_impl_linux.cc(162)] Failed to adjust OOM score of renderer with pid 16673: Permission denied
[16603:16603:0601/152101:ERROR:blob_channel_service.cc(21)] Not implemented reached in virtual void blimp::engine::BlobChannelService::Push(const mojo::String &)
[1:1:0601/152101:VERBOSE1:remote_channel_main.cc(220)] Sending initialize message to client
[1:1:0601/152101:VERBOSE1:remote_channel_main.cc(146)] Sending commit request to client.
[1:1:0601/152101:ERROR:remote_channel_main.cc(102)] Not implemented reached in virtual void cc::RemoteChannelMain::SetVisibleOnImpl(bool)Visibility is not controlled by the server
[1:1:0601/152101:ERROR:remote_channel_main.cc(102)] Not implemented reached in virtual void cc::RemoteChannelMain::SetVisibleOnImpl(bool)Visibility is not controlled by the server
[1:1:0601/152101:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 1 to client.
[1:1:0601/152101:ERROR:remote_channel_main.cc(102)] Not implemented reached in virtual void cc::RemoteChannelMain::SetVisibleOnImpl(bool)Visibility is not controlled by the server
[1:1:0601/152101:ERROR:remote_channel_main.cc(102)] Not implemented reached in virtual void cc::RemoteChannelMain::SetVisibleOnImpl(bool)Visibility is not controlled by the server
[1:1:0601/152101:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 1 to client.
[1:1:0601/152101:VERBOSE1:remote_channel_main.cc(93)] Sending defer commits: 0 to client.
[1:1:0601/152101:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152101:VERBOSE1:remote_channel_main.cc(183)] Sending commit message to client. Commit bytes size: 81161
[1:1:0601/152102:VERBOSE1:remote_channel_main.cc(146)] Sending commit request to client.
[16603:16603:0601/152102:ERROR:blimp_screen.cc(51)] Not implemented reached in virtual bool blimp::engine::BlimpScreen::IsWindowUnderCursor(gfx::NativeWindow)
[1:1:0601/152102:VERBOSE1:remote_channel_main.cc(254)] Received BeginMainFrame request from client.
[1:1:0601/152102:VERBOSE1:remote_channel_main.cc(183)] Sending commit message to client. Commit bytes size: 11734
[16603:16603:0601/152102:FATAL:navigation_controller_impl.cc(593)] Check failed: false. 
--2016-06-01 15:21:02--  https://clients2.google.com/cr/report
Resolving clients2.google.com (clients2.google.com)... 74.125.193.139, 74.125.193.101, 74.125.193.138, ...
Connecting to clients2.google.com (clients2.google.com)|74.125.193.139|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: '/dev/fd/3'

Crash dump id: 8a52e95c00000000

 Issue 617345  has been merged into this issue.

I think Engine should discard invalid navigation control command from client. see argument in crbug/617345

Obsolete, WontFix.