diff --git a/ShellTrayManager-fix-icon-actor-memory-management.patch b/ShellTrayManager-fix-icon-actor-memory-management.patch
new file mode 100644
index 0000000..eb6a9df
--- /dev/null
+++ b/ShellTrayManager-fix-icon-actor-memory-management.patch
@@ -0,0 +1,34 @@
+From 025dda0f280022f2bd8074d2c61e4410604041fa Mon Sep 17 00:00:00 2001
+From: Owen W. Taylor <otaylor@fishsoup.net>
+Date: Wed, 17 Nov 2010 21:30:31 -0500
+Subject: [PATCH] ShellTrayManager: fix icon actor memory management
+
+Becaue ShellTrayManager doesn't know if the ShellTrayIcon actors
+it creates will be added to a stage or not, it needs to adopt the
+initial floating reference count with g_object_ref_sink().
+This avoids crashes when unref'ing the actor when the tray is
+removed.
+
+Thanks for Jon McCann for help in tracking this down.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=635141
+---
+ src/shell-tray-manager.c |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/src/shell-tray-manager.c b/src/shell-tray-manager.c
+index 37368da..ec6c8ae 100644
+--- a/src/shell-tray-manager.c
++++ b/src/shell-tray-manager.c
+@@ -264,6 +264,8 @@ on_plug_added (GtkSocket        *socket,
+   child = g_hash_table_lookup (manager->priv->icons, socket);
+ 
+   child->actor = shell_tray_icon_new (SHELL_EMBEDDED_WINDOW (child->window));
++  g_object_ref_sink (child->actor);
++
+   g_signal_emit (manager, shell_tray_manager_signals[TRAY_ICON_ADDED], 0,
+                  child->actor);
+ }
+-- 
+1.7.3.2
+
diff --git a/gnome-shell.spec b/gnome-shell.spec
index c35ec08..904c192 100644
--- a/gnome-shell.spec
+++ b/gnome-shell.spec
@@ -1,6 +1,6 @@
 Name:           gnome-shell
 Version:        2.91.2
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Window management and application launching for GNOME
 
 Group:          User Interface/Desktops
@@ -11,6 +11,8 @@ Source0:        http://ftp.gnome.org/pub/GNOME/sources/gnome-shell/2.91/%{name}-
 
 # https://bugzilla.gnome.org/show_bug.cgi?id=634781
 Patch1: StFocusManager-don-t-unref-removed-groups.patch
+# https://bugzilla.gnome.org/show_bug.cgi?id=635141
+Patch2: ShellTrayManager-fix-icon-actor-memory-management.patch
 
 BuildRoot:      %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 
@@ -71,6 +73,7 @@ easy to use experience.
 %prep
 %setup -q
 %patch1 -p1 -b .unreferenced-groups
+%patch2 -p1 -b .unreferenced-groups
 
 %build
 (if ! test -x configure; then NOCONFIGURE=1 ./autogen.sh; fi;
@@ -134,6 +137,9 @@ gconftool-2 --makefile-install-rule \
 glib-compile-schemas --allow-any-name %{_datadir}/glib-2.0/schemas ||:
 
 %changelog
+* Thu Nov 18 2010 Owen Taylor <otaylor@redhat.com> - 2.91.2-3
+- Add another memory-management crasher fix from upstream
+
 * Mon Nov 15 2010 Owen Taylor <otaylor@redhat.com> - 2.91.2-2
 - Add a patch from upstream fixing a memory-management crasher