diff --git a/common/window.c b/common/window.c
index 3f2fcbdf..1149e0cb 100644
--- a/common/window.c
+++ b/common/window.c
@@ -19,7 +19,10 @@ const char *uiWindowTitle(uiWindow *w)
 {
 	if (!uiprivCheckInitializedAndThread())
 		return NULL;
-	// TODO check for w == NULL?
+	if (w == NULL) {
+		uiprivProgrammerErrorNullPointer("uiWindow", uiprivFunc);
+		return NULL;
+	}
 	return uiprivSysWindowTitle(w);
 }
 
@@ -27,7 +30,13 @@ void uiWindowSetTitle(uiWindow *w, const char *title)
 {
 	if (!uiprivCheckInitializedAndThread())
 		return;
-	// TODO check for w == NULL?
-	// TODO other errors
+	if (w == NULL) {
+		uiprivProgrammerErrorNullPointer("uiWindow", uiprivFunc);
+		return;
+	}
+	if (title == NULL) {
+		uiprivProgrammerErrorNullPointer("title", uiprivFunc);
+		return;
+	}
 	uiprivSysWindowSetTitle(w, title);
 }
diff --git a/doc/darwin-controls.md b/doc/darwin-controls.md
index f1ff446a..0e7e1c16 100644
--- a/doc/darwin-controls.md
+++ b/doc/darwin-controls.md
@@ -42,4 +42,4 @@ For all other `uiControl`s defined by libui, the returned object is of the appro
 
 * TODO
 
-TODO invalid value for c
+It is a programmer error to pass `NULL` for `c`. TODO a non-`uiControl`?
diff --git a/doc/window.md b/doc/window.md
index 96920397..f6dba0dc 100644
--- a/doc/window.md
+++ b/doc/window.md
@@ -44,6 +44,8 @@ const char *uiWindowTitle(uiWindow *w);
 
 The memory storing the title is owned by libui and should not be modified. The returned pointer is valid until the title is changed or `w` is destroyed; in general, you should not store the returned string pointer directly for later use.
 
+It is a programmer error to pass `NULL` for `w`. TODO for this and all other functions: either don't bother doing this check or do a redundant uiControl type check as well...
+
 ### `uiWindowSetTitle()`
 
 ```c
@@ -53,3 +55,5 @@ void uiWindowSetTitle(uiWindow *w, const char *title);
 `uiWindowSetTitle()` changes `w`'s title to `title`.
 
 It is a programmer error to pass `NULL` for `title`. If `title` is not valid UTF-8, `U+FFFD` characters will be used to sanitize the string.
+
+It is a programmer error to pass `NULL` for `w`.
\ No newline at end of file
diff --git a/test/controls_darwin.m b/test/controls_darwin.m
index 58b0e7ed..bec7dea3 100644
--- a/test/controls_darwin.m
+++ b/test/controls_darwin.m
@@ -43,3 +43,12 @@ Test(ControlOSVtableWithMissingHandleMethodIsProgrammerError)
 	uiRegisterControlType("name", &vtable, &osvt, 0);
 	endCheckProgrammerError(ctx);
 }
+
+Test(GettingDarwinHandleOfNullControlIsProgrammerError)
+{
+	void *ctx;
+
+	ctx = beginCheckProgrammerError("uiDarwinControlHandle(): invalid null pointer for uiControl");
+	uiDarwinControlHandle(NULL);
+	endCheckProgrammerError(ctx);
+}
diff --git a/test/window.c b/test/window.c
index ce7472f3..bc716fdd 100644
--- a/test/window.c
+++ b/test/window.c
@@ -80,3 +80,33 @@ Test(SetWindowTitle_Invalid)
 {
 	testSetWindowTitleImpl(testUTF8InvalidInput, testUTF8InvalidOutput);
 }
+
+Test(WindowTitleWIthNULLWindowIsProgrammerError)
+{
+	void *ctx;
+
+	ctx = beginCheckProgrammerError("uiWindowTitle(): invalid null pointer for uiWindow");
+	uiWindowTitle(NULL);
+	endCheckProgrammerError(ctx);
+}
+
+Test(SetWindowTitleWIthNULLWindowIsProgrammerError)
+{
+	void *ctx;
+
+	ctx = beginCheckProgrammerError("uiWindowSetTitle(): invalid null pointer for uiWindow");
+	uiWindowSetTitle(NULL, NULL);
+	endCheckProgrammerError(ctx);
+}
+
+Test(SetWindowTitleWIthNULLTitleIsProgrammerError)
+{
+	uiWindow *w;
+	void *ctx;
+
+	w = uiNewWindow();
+	ctx = beginCheckProgrammerError("uiWindowSetTitle(): invalid null pointer for title");
+	uiWindowSetTitle(w, NULL);
+	endCheckProgrammerError(ctx);
+	uiControlFree(uiControl(w));
+}