Core: fix segv UserPtr& not nullptr, but UserPtr.get() == nullptr