Fix nullptr dereference in thread-safe Channel forwarding

ipc/ipc_channel_mojo.cc

Index: ipc/ipc_channel_mojo.cc
diff --git a/ipc/ipc_channel_mojo.cc b/ipc/ipc_channel_mojo.cc
index 3d5e8553a658bb84c27dbf04bcdcfb5662c35644..c8baa42053dd255293837db860a687f0640fb275 100644
--- a/ipc/ipc_channel_mojo.cc
+++ b/ipc/ipc_channel_mojo.cc
@@ -283,7 +283,7 @@ ChannelMojo::ChannelMojo(
 
 void ChannelMojo::ForwardMessageFromThreadSafePtr(mojo::Message message) {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
-  if (!message_reader_)
+  if (!message_reader_ || !message_reader_->sender().is_bound())
     return;
   message_reader_->sender().internal_state()->ForwardMessage(
       std::move(message));
@@ -293,7 +293,7 @@ void ChannelMojo::ForwardMessageWithResponderFromThreadSafePtr(
     mojo::Message message,
     std::unique_ptr<mojo::MessageReceiver> responder) {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
-  if (!message_reader_)
+  if (!message_reader_ || !message_reader_->sender().is_bound())
     return;
   message_reader_->sender().internal_state()->ForwardMessageWithResponder(
       std::move(message), std::move(responder));