exception-safe