App Version (from "Chrome Settings > About Chrome"): 54.0.2798.0
iOS Version: 9.3.2
Device: iPhone 6s

Steps to reproduce: 

1. In the omnibox, enter a valid URL, eg "https://www.google.com", and navigate to it.
2. In the omnibox, enter a chrome:// URL, eg "chrome://flags", and navigate to it.
3. Repeat step 2 (navigate to a chrome:// URL again)
4. Press the Back button



Observed behavior:

In a debug build, I get an assert failure in crw_web_controller.mm.

[0715/115222:FATAL:crw_web_controller.mm(2311)] Check failed: (currentURL == _lastRegisteredRequestURL) || (!_lastRegisteredRequestURL.is_valid() && _documentURL.spec() == url::kAboutBlankURL). 

currentURL = [chrome://flags/]

_lastRegisteredRequestURL = [https://www.google.com/]



Expected behavior: Back-navigation to the chrome:// URL



Frequency: 100%


Other comments:

I tried to repro this in 51.0.2704.104 release.  The URL from step #1 flashes briefly in the omnibox, but then it loads the chrome:// URL again.  Tapping the back button again does the same thing; it's not possible to navigate back to the original URL.