(See SRJSUP-3366 for additional info.)
It is possible for a JIRA user's project roles and permissions to remain intact even if the user themself is deleted (e.g. if the user comes from Crowd). That means that when we get the role actors from a project, it's possible for some of the users associated with those actors to come back as null. Any method calls on the returned users should therefore be guarded by safe navigation operators or equivalent checks.