2 files changed, 13 insertions, 4 deletions
diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index c29e30347f..075ee46836 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp
@@ -1129,7 +1129,7 @@ bool CXFA_Node::IsNeedSavingXMLNode() {
                         GetElementType() == XFA_Element::Xfa);
 }
 
-CXFA_Node* CXFA_Node::GetItem(int32_t iIndex) {
+CXFA_Node* CXFA_Node::GetItemIfExists(int32_t iIndex) {
   int32_t iCount = 0;
   uint32_t dwNameHash = 0;
   for (CXFA_Node* pNode = GetNextSibling(); pNode;
@@ -1198,8 +1198,12 @@ void CXFA_Node::InsertItem(CXFA_Node* pNewInstance,
   if (iPos < 0)
     iPos = iCount;
   if (iPos == iCount) {
+    CXFA_Node* item = GetItemIfExists(iCount - 1);
+    if (!item)
+      return;
+
     CXFA_Node* pNextSibling =
-        iCount > 0 ? GetItem(iCount - 1)->GetNextSibling() : GetNextSibling();
+        iCount > 0 ? item->GetNextSibling() : GetNextSibling();
     GetParent()->InsertChild(pNewInstance, pNextSibling);
     if (bMoveDataBindingNodes) {
       std::set<CXFA_Node*> sNew;
@@ -1229,7 +1233,12 @@ void CXFA_Node::InsertItem(CXFA_Node* pNewInstance,
       ReorderDataNodes(sNew, sAfter, false);
     }
   } else {
-    CXFA_Node* pBeforeInstance = GetItem(iPos);
+    CXFA_Node* pBeforeInstance = GetItemIfExists(iPos);
+    if (!pBeforeInstance) {
+      // TODO(dsinclair): What should happen here?
+      return;
+    }
+
     GetParent()->InsertChild(pNewInstance, pBeforeInstance);
     if (bMoveDataBindingNodes) {
       std::set<CXFA_Node*> sNew;
diff --git a/xfa/fxfa/parser/cxfa_node.h b/xfa/fxfa/parser/cxfa_node.h
index 1e20ace09c..8108eeccc4 100644
--- a/xfa/fxfa/parser/cxfa_node.h
+++ b/xfa/fxfa/parser/cxfa_node.h
@@ -104,7 +104,7 @@ class CXFA_Node : public CXFA_Object {
 
   CXFA_Node* CreateInstanceIfPossible(bool bDataMerge);
   int32_t GetCount();
-  CXFA_Node* GetItem(int32_t iIndex);
+  CXFA_Node* GetItemIfExists(int32_t iIndex);
   void RemoveItem(CXFA_Node* pRemoveInstance, bool bRemoveDataBinding);
   void InsertItem(CXFA_Node* pNewInstance,
                   int32_t iPos,