Implement Connector::ApplySpec() & use to enforce navigation:frame

headless/lib/browser/headless_tab_socket_impl.h

Index: headless/lib/browser/headless_tab_socket_impl.h
diff --git a/headless/lib/browser/headless_tab_socket_impl.h b/headless/lib/browser/headless_tab_socket_impl.h
index 7990dc74e2a09bff9be574b224593ce9fe51fd2c..93cc610f252213c3b73e15bc7885dcfa3b37b493 100644
--- a/headless/lib/browser/headless_tab_socket_impl.h
+++ b/headless/lib/browser/headless_tab_socket_impl.h
@@ -31,14 +31,15 @@ class HeadlessTabSocketImpl : public HeadlessTabSocket, public TabSocket {
   void CreateMojoService(mojo::InterfaceRequest<TabSocket> request);
 
  private:
-  mojo::BindingSet<TabSocket> mojo_bindings_;
-
   base::Lock lock_;  // Protects everything below.
   AwaitNextMessageFromEmbedderCallback waiting_for_message_cb_;
   std::list<std::string> outgoing_message_queue_;
   std::list<std::string> incoming_message_queue_;
   Listener* listener_;  // NOT OWNED
 
+  // Must be listed last so it gets destructed before |waiting_for_message_cb_|.
+  mojo::BindingSet<TabSocket> mojo_bindings_;
+
   DISALLOW_COPY_AND_ASSIGN(HeadlessTabSocketImpl);
 };