The crash happens because WKWebView.backForwardList.currentItem is nil. All of the crashes happen during -webViewURLDidChange, and for same-document navigation (WebKit::WebPageProxy::didSameDocumentNavigationForFrame).

window.open by DOM can create scenarios with null backForwardList.currentItem. I'll try to create a reproduction scenario.

Hi Danyao, any update here?

Sorry I don't have update on this one yet. It was failing a low rate (a few crashes a day) so I didn't prioritize this bug.

Removed RBS label since we're not going to roll out slim nav in M69.

This is quite a lot of crashes for 0.5% experiment. We should probably keep RBS.

https://crash.corp.google.com/browse?q=expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27-%5BCRWNavigationItemHolder+initWithBackForwardListItem%3A%5D%27+AND+EXISTS+%28SELECT+1+FROM+UNNEST%28expanded_custom_data.ChromeCrashProto.experiments.ids%29+expanded_custom_data_ChromeCrashProto_experiments_ids+WHERE+expanded_custom_data_ChromeCrashProto_experiments_ids%3D%27ac4e2bf4-a0545610%27%29#-propertyselector,productname:1000,-magicsignature:50,-magicsignature2:50,-stablesignature:50,+day,-magicsignaturesorted:50

Fair enough. The crash is caused by calling [CRWNavigationItemHolder holderForBackForwardListItem] on a nil WKWebView.backForwardList.currentItem. Why currentItem is nil in [CRWWebController webViewURLDidChange] is an issue in WKWebView. The code has a DCHECK for this assertion, but looks like it's an edge case not caught in any of our tests.

I'll add a nil check in [CRWWebController webViewURLDidChange].

I was able to create a repro case for this crash. In a new tab, click on a link that exercises the following script:

window.open('', 'anything').location.replace('about:blank#');

This does two things:
1) window.open('', 'anything') creates a new child window without URL. This triggers a specific bug in WebKit that results in a WKWebView |backForwardList| is not nil but |backForwardList.currentItem| is nil (crbug.com/809287)
2) location.replace('about:blank#') triggers the crashing code path in [CRWWebController webViewURLDidChange], which was originally added to handle location.replace, but assumes that |webView.backForwardList.currentItem| is always non-null.

It seems that about:blank# is unique in triggering the condition required to generate the crash: webView.isLoading is false at the time of URL KVO. I also tried the following URLs, but for all of them, webView.isLoading is true at time of URL KVO so the crashing code path is not exercised:
- about:blank/#
- about:blank?query
- about:blank/query
- about:anything

A hypothesis is that WebKit may treat about:blank# as a same-document navigation. So it doesn't create a new WKBackForwardListItem, leaving the child window without a |currentItem| as setup by the empty window open. It's not clear to me why "about:blank/#" doesn't behave the same. 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/267717811617482c3e927c18dc514992ed1cee17

commit 267717811617482c3e927c18dc514992ed1cee17
Author: Danyao Wang <danyao@chromium.org>
Date: Tue Sep 18 20:25:43 2018

[Nav Experiment] Fix crash in [CRWWebController webViewURLDidChange].

This method looks up the current NavigationItem associated with
WKBackForwardList.currentItem and updates its URL to handle two edge
cases for location.replace. The lookup crashes if
WKBackForwardList.currentItem is nil. The correct NavigationItem to
update in this case is |self.currentNavItem|.

An egtest that triggers this scenario is added; though it's not clear
if this is the only case.

Bug:  866142 
Cq-Include-Trybots: luci.chromium.try:ios-simulator-cronet;luci.chromium.try:ios-simulator-full-configs
Change-Id: I5c76ad50296127234f498741a62b796fb4397461
Reviewed-on: https://chromium-review.googlesource.com/1228442
Reviewed-by: Eugene But <eugenebut@chromium.org>
Commit-Queue: Danyao Wang <danyao@chromium.org>
Cr-Commit-Position: refs/heads/master@{#592175}
[modify] https://crrev.com/267717811617482c3e927c18dc514992ed1cee17/ios/chrome/browser/web/window_open_by_dom_egtest.mm
[modify] https://crrev.com/267717811617482c3e927c18dc514992ed1cee17/ios/testing/data/http_server_files/window_open.html
[modify] https://crrev.com/267717811617482c3e927c18dc514992ed1cee17/ios/web/navigation/wk_based_navigation_manager_impl.mm
[modify] https://crrev.com/267717811617482c3e927c18dc514992ed1cee17/ios/web/web_state/ui/crw_web_controller.mm

Issue 899292 has been merged into this issue.