Able to reproduce the issue on Windows 7 using chrome latest canary M53-53.0.2768.0 by following steps mentioned in the above comment.

Crash report ID: 68d7763a00000000
Stack Trace:
============
Thread 0 MAGIC SIGNATURE THREAD
0x76e6bb7a	(ntdll.dll + 0x0004bb7a )	ZwWaitForSingleObject
0x000007fefcdc10ab	(KERNELBASE.dll + 0x000010ab )	WaitForSingleObjectEx
0x000007fed65936ca	(chrome_child.dll -waitable_event_win.cc:67 )	base::WaitableEvent::TimedWait(base::TimeDelta const &)
0x000007fed6585de0	(chrome_child.dll -message_pump_default.cc:57 )	base::MessagePumpDefault::Run(base::MessagePump::Delegate *)
0x000007fed6585b5c	(chrome_child.dll -run_loop.cc:35 )	base::RunLoop::Run()
0x000007fed653f3f0	(chrome_child.dll -message_loop.cc:294 )	base::MessageLoop::Run()
0x000007fed789cf5e	(chrome_child.dll -renderer_main.cc:199 )	content::RendererMain(content::MainFunctionParams const &)
0x000007fed65050ea	(chrome_child.dll -content_main_runner.cc:787 )	content::ContentMainRunnerImpl::Run()
0x000007fed6457f18	(chrome_child.dll -chrome_main.cc:84 )	ChromeMain
0x000000013f1f896a	(chrome.exe -main_dll_loader_win.cc:185 )	MainDllLoader::Launch(HINSTANCE__ *)
0x000000013f1f29d8	(chrome.exe -chrome_exe_main_win.cc:263 )	wWinMain
0x000000013f285525	(chrome.exe -exe_common.inl:255 )	__scrt_common_main_seh
0x76c159bc	(kernel32.dll + 0x000159bc )	BaseThreadInitThunk
0x76e4a2e0	(ntdll.dll + 0x0002a2e0 )	RtlUserThreadStart
Thread 20 CRASHED [0x0517a7ed / 0x00000000 @ 0x000000013f23a5e7 ]
0x000000013f23a5e7	(chrome.exe -crashpad_win.cc:150 )	DumpProcessWithoutCrash
0x000000013f23a619	(chrome.exe -crashpad_win.cc:165 )	crash_reporter::internal::`anonymous namespace'::DumpProcessWithoutCrashThread
0x76c159bc	(kernel32.dll + 0x000159bc )	BaseThreadInitThunk
0x76e4a2e0	(ntdll.dll + 0x0002a2e0 )	RtlUserThreadStart

By comparing the stack trace issue looks similar to bug 615090 .

ivanpe@ - Will you mind looking in to this issue, Since the stack trace matches this might be dupe of 615090. If this is the case feel free to merge in to it.

Thanks!

Bug 615090 is not very actionable.  Renderer process is not doing anything.  In this particular case (if the issue is consistently reproducible) this maybe more actionable.  Unfortunately I'm not the right person to look at this and I'm actually looking for a better owner of Bug 615090 (should be reassigned to hang detector code owner).

This is a Settings bug.

Navigating back to chrome://md-settings crashes due to a CHECK in md_settings_ui.cc.

[78797:78797:0616/174204:FATAL:md_settings_ui.cc(97)] Check failed: url.GetOrigin() == GURL(chrome::kChromeUISettingsURL).GetOrigin() || url.GetOrigin() == GURL(chrome::kChromeUIMdSettingsURL).GetOrigin(). 
#0 0x7f0b9815069e base::debug::StackTrace::StackTrace()
#1 0x7f0b98162ffb logging::LogMessage::~LogMessage()
#2 0x7f0b99396871 settings::MdSettingsUI::MdSettingsUI()
#3 0x7f0b9931330f (anonymous namespace)::NewWebUI<>()
#4 0x7f0b95f989b4 content::WebUIControllerFactoryRegistry::CreateWebUIControllerForURL()
#5 0x7f0b95f7eef0 content::WebContentsImpl::CreateWebUI()
#6 0x7f0b95f8d87e content::WebContentsImpl::CreateWebUIForRenderFrameHost()
#7 0x7f0b95d7338b content::RenderFrameHostImpl::UpdatePendingWebUI()
#8 0x7f0b95d76415 content::RenderFrameHostManager::UpdateStateForNavigate()
#9 0x7f0b95d75f69 content::RenderFrameHostManager::Navigate()
#10 0x7f0b95d63d39 content::NavigatorImpl::NavigateToEntry()
#11 0x7f0b95d6451f content::NavigatorImpl::NavigateToPendingEntry()
#12 0x7f0b95d5a534 content::NavigationControllerImpl::NavigateToPendingEntryInternal()
#13 0x7f0b95d571f5 content::NavigationControllerImpl::NavigateToPendingEntry()
#14 0x7f0b9933d8f1 chrome::GoBack()

... or forward.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/30f8b46a1fbea34790cd000f4a9871849461f1e4

commit 30f8b46a1fbea34790cd000f4a9871849461f1e4
Author: benwells <benwells@chromium.org>
Date: Mon Jun 20 11:35:47 2016

Revert of MD Settings: ... and we fixed all CHECK()-based URL crashes once and for all. (patchset #3 id:40001 of https://codereview.chromium.org/2076083003/ )

Reason for revert:
New test is failing on DrMemory :(

First failing build:
https://build.chromium.org/p/chromium.memory.fyi/builders/Windows%20Browser%20%28DrMemory%20full%29%20%281%29/builds/3504

Sample test output:
MdSettingsBrowserTest.BackForwardDoesntCrash:
Did not complete.

Original issue's description:
> MD Settings: ... and we fixed all CHECK()-based URL crashes once and for all.
>
> But...
>
> ONCE AND FOR ALL!
>
> BUG= 620370 
> R=groby@chromium.org
>
> Committed: https://crrev.com/b8e015295703f0f5689688a99c5d232b89db9325
> Cr-Commit-Position: refs/heads/master@{#400528}

TBR=groby@chromium.org,michaelpg@chromium.org,dbeam@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG= 620370 

Review-Url: https://codereview.chromium.org/2082563002
Cr-Commit-Position: refs/heads/master@{#400654}

[modify] https://crrev.com/30f8b46a1fbea34790cd000f4a9871849461f1e4/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
[modify] https://crrev.com/30f8b46a1fbea34790cd000f4a9871849461f1e4/chrome/browser/ui/webui/settings/md_settings_ui.cc
[modify] https://crrev.com/30f8b46a1fbea34790cd000f4a9871849461f1e4/chrome/browser/ui/webui/settings/md_settings_ui.h
[modify] https://crrev.com/30f8b46a1fbea34790cd000f4a9871849461f1e4/chrome/browser/ui/webui/settings/md_settings_ui_browsertest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c6a9b5091b097e50943e89b6511065fbdc8dd4d6

commit c6a9b5091b097e50943e89b6511065fbdc8dd4d6
Author: michaelpg <michaelpg@chromium.org>
Date: Mon Jun 20 19:04:52 2016

Re-land MD Settings fix for crash on back/forward navigation

Re-land of https://codereview.chromium.org/2076083003/ but disable test for now
due to revert in https://codereview.chromium.org/2082563002/

BUG= 620370 
R=groby@chromium.org,dbeam@chromium.org

Review-Url: https://codereview.chromium.org/2083603003
Cr-Commit-Position: refs/heads/master@{#400744}

[modify] https://crrev.com/c6a9b5091b097e50943e89b6511065fbdc8dd4d6/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
[modify] https://crrev.com/c6a9b5091b097e50943e89b6511065fbdc8dd4d6/chrome/browser/ui/webui/settings/md_settings_ui.cc
[modify] https://crrev.com/c6a9b5091b097e50943e89b6511065fbdc8dd4d6/chrome/browser/ui/webui/settings/md_settings_ui.h
[modify] https://crrev.com/c6a9b5091b097e50943e89b6511065fbdc8dd4d6/chrome/browser/ui/webui/settings/md_settings_ui_browsertest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5a2b17d1bd8241cb1b522a6ed2f992428fd94982

commit 5a2b17d1bd8241cb1b522a6ed2f992428fd94982
Author: Reilly Grant <reillyg@chromium.org>
Date: Tue Jun 21 21:52:46 2016

Disable MD Settings back/forward test under Dr. Memory.

Disabling it if defined(MEMORY_SANITIZER) only disables it under MSan.

BUG= 620370 
TBR=michaelpg@chromium.org

Review URL: https://codereview.chromium.org/2083173002 .

Cr-Commit-Position: refs/heads/master@{#401118}

[modify] https://crrev.com/5a2b17d1bd8241cb1b522a6ed2f992428fd94982/tools/valgrind/gtest_exclude/browser_tests.gtest-drmemory.txt

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/293849113866d09e01201095753b84c30c97bcc6

commit 293849113866d09e01201095753b84c30c97bcc6
Author: reillyg <reillyg@chromium.org>
Date: Wed Jun 22 18:29:00 2016

Match rename of MdSettingsBrowserTest in test exclusions.

MdSettingsBrowserTest has been renamed to MdSettingsUITest which means
the text exclusions need to be updated.

BUG= 620370 
TBR=dbeam@chromium.org
NOTRY=True

Review-Url: https://codereview.chromium.org/2090053003
Cr-Commit-Position: refs/heads/master@{#401360}

[modify] https://crrev.com/293849113866d09e01201095753b84c30c97bcc6/tools/valgrind/gtest_exclude/browser_tests.gtest-drmemory.txt