Fix Mojo broker crash on Windows.

mojo/edk/system/message_pipe_dispatcher.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/message_pipe_dispatcher.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <utility>
@@ skipping 968 matching lines @@
       } else {
         CHECK_NE(non_transferable_state_, CLOSED);
         internal::g_broker->CloseMessagePipe(pipe_id_, this);
         non_transferable_state_ = CLOSED;
       }
       channel_ = nullptr;
       if (close_requested_) {
         // Balance AddRef in CloseOnIO.
         call_release = true;
       }
+    } else if (!channel_ && !transferable_ &&
+               non_transferable_state_ == WAITING_FOR_CONNECT_TO_CLOSE) {
+      // Balance AddRef in CloseOnIO.
+      call_release = true;
     }
     awakable_list_.AwakeForStateChange(GetHandleSignalsStateImplNoLock());
     started_transport_.Release();
   } else {
     // We must be waiting to call ReleaseHandle. It will call Shutdown.
   }
 
   if (call_release)
     Release();
 }
@@ skipping 57 matching lines @@
   // PostTask since the broker can call us back synchronously.
   internal::g_io_thread_task_runner->PostTask(
       FROM_HERE,
       base::Bind(&Broker::ConnectMessagePipe,
                  base::Unretained(internal::g_broker), pipe_id_,
                  base::Unretained(this)));
 }
 
 }  // namespace edk
 }  // namespace mojo