safe pointer
allow throwing exception on fatal error