diff --git a/at-spi2-core.spec b/at-spi2-core.spec
index 948b12b..e54d8b0 100644
--- a/at-spi2-core.spec
+++ b/at-spi2-core.spec
@@ -1,6 +1,6 @@
 Name:           at-spi2-core
 Version:        2.20.2
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Protocol definitions and daemon for D-Bus at-spi
 
 Group:          System Environment/Libraries
@@ -8,6 +8,9 @@ License:        LGPLv2+
 URL:            http://www.linuxfoundation.org/en/AT-SPI_on_D-Bus
 Source0:        http://download.gnome.org/sources/at-spi2-core/2.20/%{name}-%{version}.tar.xz
 
+Patch0:         atspi-accessible-clear-cache-crash.patch
+Patch1:         handle-at-spi2-registryd-dying.patch
+
 BuildRequires:  dbus-devel
 BuildRequires:  dbus-glib-devel
 BuildRequires:  glib2-devel
@@ -42,7 +45,7 @@ The at-spi2-core-devel package includes the header files and
 API documentation for libatspi.
 
 %prep
-%setup -q
+%autosetup -p1
 
 %build
 autoreconf -v --install --force
@@ -83,6 +86,9 @@ rm $RPM_BUILD_ROOT%{_libdir}/libatspi.la
 %{_libdir}/pkgconfig/atspi-2.pc
 
 %changelog
+* Fri Jul 22 2016 Michael Catanzaro <mcatanzaro@gnome.org> - 2.20.2-2
+- Fix two crashes
+
 * Sun May 22 2016 Kalev Lember <klember@redhat.com> - 2.20.2-1
 - Update to 2.20.2
 
diff --git a/atspi-accessible-clear-cache-crash.patch b/atspi-accessible-clear-cache-crash.patch
new file mode 100644
index 0000000..1cf2cab
--- /dev/null
+++ b/atspi-accessible-clear-cache-crash.patch
@@ -0,0 +1,31 @@
+From c565ece411b770856d5ae11eff1929a22133367b Mon Sep 17 00:00:00 2001
+From: Mike Gorse <mgorse@suse.com>
+Date: Tue, 31 May 2016 14:44:17 -0500
+Subject: atspi_accessible_clear_cache: don't crash if we have no children
+
+If an accessible is disposed, then its list of children may be NULL.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=767075
+---
+ atspi/atspi-accessible.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/atspi/atspi-accessible.c b/atspi/atspi-accessible.c
+index ceaedb5..4547ef7 100644
+--- a/atspi/atspi-accessible.c
++++ b/atspi/atspi-accessible.c
+@@ -1634,8 +1634,9 @@ atspi_accessible_clear_cache (AtspiAccessible *obj)
+   if (obj)
+   {
+     obj->cached_properties = ATSPI_CACHE_NONE;
+-    for (i = 0; i < obj->children->len; i++)
+-      atspi_accessible_clear_cache (g_ptr_array_index (obj->children, i));
++    if (obj->children)
++      for (i = 0; i < obj->children->len; i++)
++        atspi_accessible_clear_cache (g_ptr_array_index (obj->children, i));
+   }
+ }
+ 
+-- 
+cgit v0.12
+
diff --git a/handle-at-spi2-registryd-dying.patch b/handle-at-spi2-registryd-dying.patch
new file mode 100644
index 0000000..3144514
--- /dev/null
+++ b/handle-at-spi2-registryd-dying.patch
@@ -0,0 +1,31 @@
+From 9b2c6f2f6d8ea9ec4d65f664910b73a6f317104b Mon Sep 17 00:00:00 2001
+From: Mike Gorse <mgorse@suse.com>
+Date: Thu, 2 Jun 2016 18:53:26 -0500
+Subject: Correctly handle at-spi2-registryd dying when processing
+ NameOwnerChanged
+
+If at-spi2-registryd dies, then we receive two NameOwnerChanged signals,
+one for org.a11y.atspi.Registry and the other for the initial dbus-issued
+name. When we received the latter, we were matching it to the AtspiApplication
+corresponding to the desktop and inadvertently disposing it, leading to a
+crash later on.
+---
+ atspi/atspi-misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/atspi/atspi-misc.c b/atspi/atspi-misc.c
+index 1ec9be1..1dcc3de 100644
+--- a/atspi/atspi-misc.c
++++ b/atspi/atspi-misc.c
+@@ -389,7 +389,7 @@ handle_name_owner_changed (DBusConnection *bus, DBusMessage *message, void *user
+   else if (app_hash)
+   {
+     AtspiApplication *app = g_hash_table_lookup (app_hash, old);
+-    if (app)
++    if (app && !strcmp (app->bus_name, old))
+       g_object_run_dispose (G_OBJECT (app));
+   }
+   return DBUS_HANDLER_RESULT_HANDLED;
+-- 
+cgit v0.12
+