Fix nullptr dereference in thread-safe Channel forwarding

ipc/ipc_channel_mojo.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ipc/ipc_channel_mojo.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
@@ skipping 265 matching lines @@
     const scoped_refptr<base::SingleThreadTaskRunner>& ipc_task_runner)
     : task_runner_(ipc_task_runner),
       pipe_(handle.get()),
       listener_(listener),
       weak_factory_(this) {
   bootstrap_ = MojoBootstrap::Create(std::move(handle), mode, ipc_task_runner);
 }
 
 void ChannelMojo::ForwardMessageFromThreadSafePtr(mojo::Message message) {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
-  if (!message_reader_)
+  if (!message_reader_ || !message_reader_->sender().is_bound())
     return;
   message_reader_->sender().internal_state()->ForwardMessage(
       std::move(message));
 }
 
 void ChannelMojo::ForwardMessageWithResponderFromThreadSafePtr(
     mojo::Message message,
     std::unique_ptr<mojo::MessageReceiver> responder) {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
-  if (!message_reader_)
+  if (!message_reader_ || !message_reader_->sender().is_bound())
     return;
   message_reader_->sender().internal_state()->ForwardMessageWithResponder(
       std::move(message), std::move(responder));
 }
 
 ChannelMojo::~ChannelMojo() {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
   Close();
 }
 
@@ skipping 174 matching lines @@
 }
 
 void ChannelMojo::GetGenericRemoteAssociatedInterface(
     const std::string& name,
     mojo::ScopedInterfaceEndpointHandle handle) {
   if (message_reader_)
     message_reader_->GetRemoteInterface(name, std::move(handle));
 }
 
 }  // namespace IPC