diff --git a/ifs-crash.sh b/ifs-crash.sh
new file mode 100644
index 0000000..88d7301
--- /dev/null
+++ b/ifs-crash.sh
@@ -0,0 +1,39 @@
+#!/bin/ksh
+
+trap 'echo "[${0##*/}: crash]"' SIGSEGV SIGABRT SIGBUS SIGFPE
+
+function crash
+{
+  typeset L_FILE
+  typeset L_VALIDATION
+  typeset L_VARIABLE
+  typeset L_MOD IFS
+
+  OS=$(uname)
+}
+
+crash
+
+function crash2
+{
+  typeset IFS
+  IFS='\t'
+  true
+  unset IFS
+  echo a b c | while read x y z; do
+    echo $x
+    echo $y
+    echo $z
+  done
+}
+
+crash2
+
+echo a b c | while read x y z; do
+  echo $x
+  echo $y
+  echo $z
+done
+
+echo "[${0##*/}: success]"
+# end here
diff --git a/ksh.changes b/ksh.changes
index bd523bc..69212ac 100644
--- a/ksh.changes
+++ b/ksh.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Oct 11 14:53:35 CEST 2010 - werner@suse.de
+
+- Add script for testing out the previous bug
+
 -------------------------------------------------------------------
 Fri Oct  8 14:50:56 CEST 2010 - werner@suse.de
 
diff --git a/ksh.spec b/ksh.spec
index 19169ae..2cb17ba 100644
--- a/ksh.spec
+++ b/ksh.spec
@@ -46,6 +46,7 @@ Source2:        ast-ksh-locale.2010-02-02.tar.bz2
 Source3:        CPL
 Source10:       leak1.sh
 Source11:       leak2.sh
+Source12:       ifs-crash.sh
 Source20:       Agreement
 Source21:       Warning
 Source30:       rpmlintrc
@@ -361,6 +362,7 @@ find share/ -type d -a -empty | xargs -r rm -vrf
  	  ${root}/bin/ksh.test shtests
 	  ${root}/bin/ksh.test %{S:10}
 	  ${root}/bin/ksh.test %{S:11}
+	  ${root}/bin/ksh.test %{S:12}
           if test $((IGNORED & SIGPIPE)) -eq 0 ; then
 	      # This may fail in current factory (aka next 11.3)
 	      ${root}/bin/ksh.test -c 'g="false"; trap "print -u2 PIPED; \$g && exit 0 ; g=true" PIPE ; while true ; do echo hello ; done' | head -n 10
diff --git a/ksh93-ifs.dif b/ksh93-ifs.dif
index 724e766..883c590 100644
--- a/ksh93-ifs.dif
+++ b/ksh93-ifs.dif
@@ -1,37 +1,10 @@
 --- src/cmd/ksh93/sh/init.c
-+++ src/cmd/ksh93/sh/init.c	2010-10-08 12:43:27.123926224 +0000
-@@ -456,6 +456,8 @@ static void put_cdpath(register Namval_t
-     }
- #endif /* _hdr_locale */
- 
-+static const void* ifs_hdr;
-+
- /* Trap for IFS assignment and invalidates state table */
- static void put_ifs(register Namval_t* np,const char *val,int flags,Namfun_t *fp)
- {
-@@ -464,9 +466,14 @@ static void put_ifs(register Namval_t* n
- 	ip->ifsnp = 0;
- 	if(!val)
- 	{
--		fp = nv_stack(np, NIL(Namfun_t*));
--		if(fp && !fp->nofree)
--			free((void*)fp);
-+		Namfun_t *xp = nv_stack(np, NIL(Namfun_t*));
-+		if(xp)
-+		{
-+			if(xp == ifs_hdr)
-+				xp->nofree = 1;
-+			if(xp->nofree == 0)
-+				free((void*)xp);
-+		}
- 	}
- 	if(val != np->nvalue.cp)
- 		nv_putv(np, val, flags, fp);
-@@ -1597,6 +1604,7 @@ static Init_t *nv_init(Shell_t *shp)
++++ src/cmd/ksh93/sh/init.c	Fri Oct  8 13:16:10 2010
+@@ -1709,6 +1709,7 @@
  	ip->LANG_init.nofree = 1;
  #endif /* _hdr_locale */
  	nv_stack(IFSNOD, &ip->IFS_init.hdr);
-+	ifs_hdr = (IFSNOD)->nvfun;
++	ip->IFS_init.hdr.nofree = 1;
  	nv_stack(PATHNOD, &ip->PATH_init);
  	nv_stack(FPATHNOD, &ip->FPATH_init);
  	nv_stack(CDPNOD, &ip->CDPATH_init);