don't crash if time is *really* invalid