I can reproduce the URL issue on slow network. There are a few issues:

1) ErrorRetryStateMachine should not be triggered for errors that don't result in displaying of error messages (e.g. canceled). This is the same underlying issue as crbug.com/837210.

2) DCHECK in CRWWebController |-webView:didReceiveAuthenticationChallenge| is due to  crbug.com/864525 

3) DCHECK(!IsPlaceholderUrl(webViewURL)) in |-webView:DidFailProvisionalNavigation| due to failure delegate called after WKWebView has already navigated back to another page. It is not correct to assume that webView.URL is the URL of the page triggering the error.

4) Strange URLs come from subresources. This bug may be introduced by https://chromium-review.googlesource.com/1142142

(3) fixed in https://chromium-review.googlesource.com/c/chromium/src/+/1151391

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d042d23abbbf841b92dcba3ab9943e8bd545b402

commit d042d23abbbf841b92dcba3ab9943e8bd545b402
Author: Danyao Wang <danyao@chromium.org>
Date: Fri Jul 27 14:45:34 2018

[Nav Experiment] Only create pending item for main frame decidePolicy.

|webView:decidePolicyForNavigationAction| is called on subresources
load as well. Pending item and context should not be updated in this
case, otherwise it causes the incorrect CL to be displayed.

Bug:  865893 , 866379
Cq-Include-Trybots: luci.chromium.try:ios-simulator-full-configs;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: Icd721c8044b32cb5088631812ffe2de3c95c9c1b
Reviewed-on: https://chromium-review.googlesource.com/1152112
Reviewed-by: Kurt Horimoto <kkhorimoto@chromium.org>
Commit-Queue: Danyao Wang <danyao@chromium.org>
Cr-Commit-Position: refs/heads/master@{#578637}
[modify] https://crrev.com/d042d23abbbf841b92dcba3ab9943e8bd545b402/ios/web/web_state/ui/crw_web_controller.mm

Canary verification please.

automatically phone supported

Issue verified 
Version: Chrome Canary  70.0.3508.0
Device: iPhone 8
iOS: 11.4

Correct URL on back/forward
https://drive.google.com/open?id=1rBPFKba1YU62YU3uO_hm2dxe1FozfzLs

Your change meets the bar and is auto-approved for M69. Please go ahead and merge the CL to branch 3497 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), kariahda@(iOS), cindyb@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/60b84e9764c552290031e38637dabcc20ce0ea7f

commit 60b84e9764c552290031e38637dabcc20ce0ea7f
Author: Danyao Wang <danyao@chromium.org>
Date: Wed Aug 01 04:54:50 2018

[Nav Experiment] Only create pending item for main frame decidePolicy.

Cherry-pick to M69 (refs/branch-heads/3497).

|webView:decidePolicyForNavigationAction| is called on subresources
load as well. Pending item and context should not be updated in this
case, otherwise it causes the incorrect CL to be displayed.

Bug:  865893 , 866379
Cq-Include-Trybots: luci.chromium.try:ios-simulator-full-configs;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: Icd721c8044b32cb5088631812ffe2de3c95c9c1b
Reviewed-on: https://chromium-review.googlesource.com/1152112
Reviewed-by: Kurt Horimoto <kkhorimoto@chromium.org>
Commit-Queue: Danyao Wang <danyao@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#578637}(cherry picked from commit d042d23abbbf841b92dcba3ab9943e8bd545b402)
Reviewed-on: https://chromium-review.googlesource.com/1158024
Reviewed-by: Danyao Wang <danyao@chromium.org>
Cr-Commit-Position: refs/branch-heads/3497@{#309}
Cr-Branched-From: 271eaf50594eb818c9295dc78d364aea18c82ea8-refs/heads/master@{#576753}
[modify] https://crrev.com/60b84e9764c552290031e38637dabcc20ce0ea7f/ios/web/web_state/ui/crw_web_controller.mm

Verified in:

App Version: 69.0.3497.25 beta
iOS Version: 10.3.3, 11.4.1, 12.0 beta 5
Devices: iPhone 7 Plus, iPhone 6 Plus, iPhone 8 Plus

Shows valid URL on back/forward navigation

Issue verified 
Version: Chrome Beta 69.0.3497.31
Device: iPhone 8
iOS: 11.4

Correct URL
https://drive.google.com/open?id=18V37lSk06PdE2KiGnZbfWjVPFqvo0mOU