Fix nullptr dereference in thread-safe Channel forwarding

It's possible to hit IPc::ChannelMojo::ForwardMessage* while
the MessagePipeReader is still alive but has closed its sender
binding. This fixes that.

BUG=690493
TEST=content_browsertests with ASAN

Review-Url: https://codereview.chromium.org/2682223005
Cr-Commit-Position: refs/heads/master@{#449413}
1 file changed