defensive null check