diff --git a/src/hb-subset-plan.cc b/src/hb-subset-plan.cc
index 8a940317d..4f9fa0b03 100644
--- a/src/hb-subset-plan.cc
+++ b/src/hb-subset-plan.cc
@@ -458,7 +458,7 @@ _nameid_closure (hb_face_t *face,
 }
 
 /**
- * hb_subset_plan_create:
+ * hb_subset_plan_create_or_fail:
  * @face: font face to create the plan for.
  * @input: a #hb_subset_input_t input.
  *
@@ -467,17 +467,18 @@ _nameid_closure (hb_face_t *face,
  * which tables and glyphs should be retained.
  *
  * Return value: (transfer full): New subset plan. Destroy with
- * hb_subset_plan_destroy().
+ * hb_subset_plan_destroy(). If there is a failure creating the plan
+ * nullptr will be returned.
  *
  * Since: REPLACEME
  **/
 hb_subset_plan_t *
-hb_subset_plan_create (hb_face_t	 *face,
-		       const hb_subset_input_t *input)
+hb_subset_plan_create_or_fail (hb_face_t	 *face,
+                               const hb_subset_input_t *input)
 {
   hb_subset_plan_t *plan;
   if (unlikely (!(plan = hb_object_create<hb_subset_plan_t> ())))
-    return const_cast<hb_subset_plan_t *> (&Null (hb_subset_plan_t));
+    return nullptr;
 
   plan->successful = true;
   plan->flags = input->flags;
@@ -514,8 +515,8 @@ hb_subset_plan_create (hb_face_t	 *face,
   plan->layout_variation_indices = hb_set_create ();
   plan->layout_variation_idx_map = hb_map_create ();
 
-  if (plan->in_error ()) {
-    return plan;
+  if (unlikely (plan->in_error ())) {
+    return nullptr;
   }
 
   _populate_unicodes_to_retain (input->sets.unicodes, input->sets.glyphs, plan);
@@ -532,6 +533,9 @@ hb_subset_plan_create (hb_face_t	 *face,
 				  plan->reverse_glyph_map,
 				  &plan->_num_output_glyphs);
 
+  if (unlikely (plan->in_error ())) {
+    return nullptr;
+  }
   return plan;
 }
 
diff --git a/src/hb-subset.cc b/src/hb-subset.cc
index 292229c4b..3d3b23062 100644
--- a/src/hb-subset.cc
+++ b/src/hb-subset.cc
@@ -343,9 +343,8 @@ hb_subset_or_fail (hb_face_t *source, const hb_subset_input_t *input)
 {
   if (unlikely (!input || !source)) return hb_face_get_empty ();
 
-  hb_subset_plan_t *plan = hb_subset_plan_create (source, input);
-  if (unlikely (plan->in_error ())) {
-    hb_subset_plan_destroy (plan);
+  hb_subset_plan_t *plan = hb_subset_plan_create_or_fail (source, input);
+  if (unlikely (!plan)) {
     return nullptr;
   }
 
@@ -367,7 +366,7 @@ hb_subset_or_fail (hb_face_t *source, const hb_subset_input_t *input)
 hb_face_t *
 hb_subset_plan_execute_or_fail (hb_subset_plan_t *plan)
 {
-  if (unlikely (plan->in_error ())) {
+  if (unlikely (!plan || plan->in_error ())) {
     return nullptr;
   }
 
diff --git a/src/hb-subset.h b/src/hb-subset.h
index 4872d89c3..edc909086 100644
--- a/src/hb-subset.h
+++ b/src/hb-subset.h
@@ -158,8 +158,8 @@ HB_EXTERN hb_face_t *
 hb_subset_plan_execute_or_fail (hb_subset_plan_t *plan);
 
 HB_EXTERN hb_subset_plan_t *
-hb_subset_plan_create (hb_face_t                 *face,
-		       const hb_subset_input_t   *input);
+hb_subset_plan_create_or_fail (hb_face_t                 *face,
+                               const hb_subset_input_t   *input);
 
 HB_EXTERN void
 hb_subset_plan_destroy (hb_subset_plan_t *plan);
diff --git a/test/api/test-subset.c b/test/api/test-subset.c
index 1dcc5ff26..ee332777f 100644
--- a/test/api/test-subset.c
+++ b/test/api/test-subset.c
@@ -167,7 +167,8 @@ test_subset_plan (void)
   hb_subset_input_t* input = hb_subset_test_create_input (codepoints);
   hb_set_destroy (codepoints);
 
-  hb_subset_plan_t* plan = hb_subset_plan_create (face_abc, input);
+  hb_subset_plan_t* plan = hb_subset_plan_create_or_fail (face_abc, input);
+  g_assert (plan);
 
   const hb_map_t* mapping = hb_subset_plan_old_to_new_glyph_mapping (plan);
   g_assert (hb_map_get (mapping, 1) == 1);