Fix UAF in new Mojo EDK.

mojo/edk/system/child_broker.cc

Index: mojo/edk/system/child_broker.cc
diff --git a/mojo/edk/system/child_broker.cc b/mojo/edk/system/child_broker.cc
index d686e74229ed765654e29ebea81af63344bf4cdd..703f2adbf1d6dbdedeb971bbcd84587002197d9a 100644
--- a/mojo/edk/system/child_broker.cc
+++ b/mojo/edk/system/child_broker.cc
@@ -272,7 +272,9 @@ void ChildBroker::AttachMessagePipe(MessagePipeDispatcher* message_pipe,
   // then when it's read it returns no messages because it doesn't have the
   // channel yet.
   message_pipe->GotNonTransferableChannel(raw_channel->channel());
-  raw_channel->AddRoute(pipe_id, message_pipe);
+  // The above call could have caused |CloseMessagePipe| to be called.
+  if (connected_pipes_.find(message_pipe) != connected_pipes_.end())
+    raw_channel->AddRoute(pipe_id, message_pipe);
 }
 
 #if defined(OS_WIN)