diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 8e208ee..573982f 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2020-04-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in WebCore::HTMLDocumentParser::insert
+        https://bugs.webkit.org/show_bug.cgi?id=209892
+
+        Reviewed by Darin Adler.
+
+        Speculative fix to check that the parser hasn't been detached before running preload scanner.
+
+        No new tests since there is no reproduction and I couldn't come up with one.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        (WebCore::HTMLDocumentParser::insert):
+
 2020-04-01  Jack Lee  <shihchieh_lee@apple.com>
 
         Remove the unnecessary null check for document
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.cpp b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
index cce9eda..567c9dd 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.cpp
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
@@ -333,7 +333,7 @@
     if (shouldResume)
         m_parserScheduler->scheduleForResume();
 
-    if (isWaitingForScripts()) {
+    if (isWaitingForScripts() && !isDetached()) {
         ASSERT(m_tokenizer.isInDataState());
         if (!m_preloadScanner) {
             m_preloadScanner = makeUnique<HTMLPreloadScanner>(m_options, document()->url(), document()->deviceScaleFactor());
@@ -391,7 +391,7 @@
     m_input.insertAtCurrentInsertionPoint(WTFMove(source));
     pumpTokenizerIfPossible(ForceSynchronous);
 
-    if (isWaitingForScripts()) {
+    if (isWaitingForScripts() && !isDetached()) {
         // Check the document.write() output with a separate preload scanner as
         // the main scanner can't deal with insertions.
         if (!m_insertionPreloadScanner)