This happens with --enable-features=BrowserContainerContainsNTP and slim nav off.

Steps to reproduce:
(1) Open new tab
(2) Type amazon.com into Omnibox
(3) After page is fully loaded, tap back

Expected result:
chrome://newtab is show


Actual result: DCHECK in WebStateImpl::GetCurrentURL()

thread #1, name = 'CrWebMain', queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=EXC_I386_BPT, subcode=0x0)
    frame #0: 0x000000010675f644 Chromium`base::debug::BreakDebugger() at debugger_posix.cc:274
    frame #1: 0x000000010655e2ac Chromium`logging::LogMessage::~LogMessage(this=0x00007ffeeba16820) at logging.cc:876
    frame #2: 0x000000010655cb65 Chromium`logging::LogMessage::~LogMessage(this=0x00007ffeeba16820) at logging.cc:586
  * frame #3: 0x0000000105250cc6 Chromium`web::WebStateImpl::GetCurrentURL(this=0x00007fb71ce676b0, trust_level=0x00007ffeeba16a7c) const at web_state_impl.mm:680
    frame #4: 0x00000001093be78a Chromium`password_manager::GetPageURLAndCheckTrustLevel(web_state=0x00007fb71ce676b0, page_url=0x00007ffeeba16b20) at password_form_helper.mm:40
    frame #5: 0x00000001055266fa Chromium`::-[PasswordController webState:didLoadPageWithSuccess:](self=0x00007fb71ce67fe0, _cmd="webState:didLoadPageWithSuccess:", webState=0x00007fb71ce676b0, success=NO) at password_controller.mm:280
    frame #6: 0x000000010525cae3 Chromium`web::WebStateObserverBridge::PageLoaded(this=0x000060800001dcd0, web_state=0x00007fb71ce676b0, load_completion_status=FAILURE) at web_state_observer_bridge.mm:94
    frame #7: 0x000000010524cb6d Chromium`web::WebStateImpl::OnPageLoaded(this=0x00007fb71ce676b0, url=0x00007ffeeba16fb0, load_success=false) at web_state_impl.mm:264
    frame #8: 0x0000000105178031 Chromium`::-[CRWWebController loadErrorPageForNavigationItem:navigationContext:](self=0x00007fb71ce67900, _cmd="loadErrorPageForNavigationItem:navigationContext:", item=0x00007fb71d8dda00, context=0x0000618000189f40) at crw_web_controller.mm:1793
    frame #9: 0x0000000105178e5f Chromium`::-[CRWWebController handleErrorRetryCommand:navigationItem:navigationContext:](self=0x00007fb71ce67900, _cmd="handleErrorRetryCommand:navigationItem:navigationContext:", command=kLoadErrorView, item=0x00007fb71d8dda00, context=0x0000618000189f40) at crw_web_controller.mm:1886
    frame #10: 0x0000000105187cd4 Chromium`::-[CRWWebController handleLoadError:forNavigation:provisionalLoad:](self=0x00007fb71ce67900, _cmd="handleLoadError:forNavigation:provisionalLoad:", error=domain: "NSURLErrorDomain" - code: 18446744073709550614, navigation=0x00007fb71cd5bf20, provisionalLoad=YES) at crw_web_controller.mm:3137
    frame #11: 0x000000010519a2ad Chromium`::-[CRWWebController webView:didFailProvisionalNavigation:withError:](self=0x00007fb71ce67900, _cmd="webView:didFailProvisionalNavigation:withError:", webView=0x00007fb72480fc00, navigation=0x00007fb71cd5bf20, error=domain: "NSURLErrorDomain" - code: 18446744073709550614) at crw_web_controller.mm:4741
    frame #12: 0x000000011e3333b2 WebKit`WebKit::NavigationState::NavigationClient::didFailProvisionalNavigationWithError(WebKit::WebPageProxy&, WebKit::WebFrameProxy&, API::Navigation*, WebCore::ResourceError const&, API::Object*) + 146
    frame #13: 0x000000011e4e82dd WebKit`WebKit::WebPageProxy::didFailProvisionalLoadForFrame(unsigned long long, WebCore::SecurityOriginData const&, unsigned long long, WTF::String const&, WebCore::ResourceError const&, WebKit::UserData const&) + 345
    frame #14: 0x000000011e509b2d WebKit`void IPC::handleMessage<Messages::WebPageProxy::DidFailProvisionalLoadForFrame, WebKit::WebPageProxy, void (WebKit::WebPageProxy::*)(unsigned long long, WebCore::SecurityOriginData const&, unsigned long long, WTF::String const&, WebCore::ResourceError const&, WebKit::UserData const&)>(IPC::Decoder&, WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(unsigned long long, WebCore::SecurityOriginData const&, unsigned long long, WTF::String const&, WebCore::ResourceError const&, WebKit::UserData const&)) + 191
    frame #15: 0x000000011e32fcdf WebKit`IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 127
    frame #16: 0x000000011e56644a WebKit`WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 24