Push service may be null and must only be used on the UI thread.

content/browser/push_messaging/push_messaging_message_filter.h

Index: content/browser/push_messaging/push_messaging_message_filter.h
diff --git a/content/browser/push_messaging/push_messaging_message_filter.h b/content/browser/push_messaging/push_messaging_message_filter.h
index 60ea948ad1dd0a435b869c20a0b1d41f3cf3d411..85134e37bf68013e1370f685c5f58bc0cec53253 100644
--- a/content/browser/push_messaging/push_messaging_message_filter.h
+++ b/content/browser/push_messaging/push_messaging_message_filter.h
@@ -82,6 +82,9 @@ class PushMessagingMessageFilter : public BrowserMessageFilter {
   void SendRegisterSuccess(const RegisterData& data,
                            const std::string& push_registration_id);
 
+  // Returns a push messaging service. The embedder owns the service, and is
+  // responsible for ensuring that it outlives RenderProcessHost. It's valid to
+  // return NULL. Must be called on the UI thread.
   PushMessagingService* service();
 
   int render_process_id_;