3 files changed, 16 insertions, 6 deletions
diff --git a/fxjs/xfa/cjx_instancemanager.cpp b/fxjs/xfa/cjx_instancemanager.cpp
index a5e3295c9b..d6ac66d9df 100644
--- a/fxjs/xfa/cjx_instancemanager.cpp
+++ b/fxjs/xfa/cjx_instancemanager.cpp
@@ -77,9 +77,13 @@ int32_t CJX_InstanceManager::SetInstances(int32_t iDesired) {
     }
   } else {
     while (iCount < iDesired) {
-      CXFA_Node* pNewInstance = GetXFANode()->CreateInstance(true);
+      CXFA_Node* pNewInstance = GetXFANode()->CreateInstanceIfPossible(true);
+      if (!pNewInstance)
+        return 0;
+
       GetXFANode()->InsertItem(pNewInstance, iCount, iCount, false);
-      iCount++;
+      ++iCount;
+
       CXFA_FFNotify* pNotify = GetDocument()->GetNotify();
       if (!pNotify)
         return 0;
@@ -206,7 +210,10 @@ CJS_Return CJX_InstanceManager::addInstance(
   if (iMax >= 0 && iCount >= iMax)
     return CJS_Return(JSGetStringFromID(JSMessage::kTooManyOccurances));
 
-  CXFA_Node* pNewInstance = GetXFANode()->CreateInstance(fFlags);
+  CXFA_Node* pNewInstance = GetXFANode()->CreateInstanceIfPossible(fFlags);
+  if (!pNewInstance)
+    return CJS_Return(runtime->NewNull());
+
   GetXFANode()->InsertItem(pNewInstance, iCount, iCount, false);
 
   CXFA_FFNotify* pNotify = GetDocument()->GetNotify();
@@ -248,7 +255,10 @@ CJS_Return CJX_InstanceManager::insertInstance(
   if (iMax >= 0 && iCount >= iMax)
     return CJS_Return(JSGetStringFromID(JSMessage::kInvalidInputError));
 
-  CXFA_Node* pNewInstance = GetXFANode()->CreateInstance(bBind);
+  CXFA_Node* pNewInstance = GetXFANode()->CreateInstanceIfPossible(bBind);
+  if (!pNewInstance)
+    return CJS_Return(runtime->NewNull());
+
   GetXFANode()->InsertItem(pNewInstance, iIndex, iCount, true);
 
   CXFA_FFNotify* pNotify = GetDocument()->GetNotify();
diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index 2cf521f44b..c29e30347f 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp
@@ -1284,7 +1284,7 @@ void CXFA_Node::RemoveItem(CXFA_Node* pRemoveInstance,
   }
 }
 
-CXFA_Node* CXFA_Node::CreateInstance(bool bDataMerge) {
+CXFA_Node* CXFA_Node::CreateInstanceIfPossible(bool bDataMerge) {
   CXFA_Document* pDocument = GetDocument();
   CXFA_Node* pTemplateNode = GetTemplateNodeIfExists();
   if (!pTemplateNode)
diff --git a/xfa/fxfa/parser/cxfa_node.h b/xfa/fxfa/parser/cxfa_node.h
index d8689859be..1e20ace09c 100644
--- a/xfa/fxfa/parser/cxfa_node.h
+++ b/xfa/fxfa/parser/cxfa_node.h
@@ -102,7 +102,7 @@ class CXFA_Node : public CXFA_Object {
   void SetFlag(uint32_t dwFlag, bool bNotify);
   void ClearFlag(uint32_t dwFlag);
 
-  CXFA_Node* CreateInstance(bool bDataMerge);
+  CXFA_Node* CreateInstanceIfPossible(bool bDataMerge);
   int32_t GetCount();
   CXFA_Node* GetItem(int32_t iIndex);
   void RemoveItem(CXFA_Node* pRemoveInstance, bool bRemoveDataBinding);