defensive null pointer handling