diff --git a/0001-patch-8.1.0121-crash-when-using-ballooneval-related-.patch b/0001-patch-8.1.0121-crash-when-using-ballooneval-related-.patch
new file mode 100644
index 0000000..608349e
--- /dev/null
+++ b/0001-patch-8.1.0121-crash-when-using-ballooneval-related-.patch
@@ -0,0 +1,130 @@
+From 1e36677f8d4c57bb0e90b8a1136c392cc3b301c7 Mon Sep 17 00:00:00 2001
+From: Bram Moolenaar <Bram@vim.org>
+Date: Thu, 28 Jun 2018 12:05:11 +0200
+Subject: [PATCH] patch 8.1.0121: crash when using ballooneval related to
+ 'vartabstop'
+
+Problem:    Crash when using ballooneval related to 'vartabstop'.
+Solution:   Initialize balloonEval->vts to NULL. (Markus Braun)
+---
+ src/ex_cmds2.c  |  2 +-
+ src/gui.c       |  5 +++++
+ src/gui_beval.c | 11 +----------
+ src/gui_w32.c   |  9 +--------
+ src/version.c   |  2 ++
+ 5 files changed, 10 insertions(+), 19 deletions(-)
+
+diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c
+index 01bc357f4..5f58fedfb 100644
+--- a/src/ex_cmds2.c
++++ b/src/ex_cmds2.c
+@@ -1419,7 +1419,7 @@ check_due_timer(void)
+ 	    bevalexpr_due_set = FALSE;
+ 	    if (balloonEval == NULL)
+ 	    {
+-		balloonEval = (BalloonEval *)alloc(sizeof(BalloonEval));
++		balloonEval = (BalloonEval *)alloc_clear(sizeof(BalloonEval));
+ 		balloonEvalForTerm = TRUE;
+ 	    }
+ 	    if (balloonEval != NULL)
+diff --git a/src/gui.c b/src/gui.c
+index 87ea5ce2b..f51b81f86 100644
+--- a/src/gui.c
++++ b/src/gui.c
+@@ -745,7 +745,12 @@ gui_init(void)
+ 	/* Always create the Balloon Evaluation area, but disable it when
+ 	 * 'ballooneval' is off. */
+ 	if (balloonEval != NULL)
++	{
++# ifdef FEAT_VARTABS
++	    vim_free(balloonEval->vts);
++# endif
+ 	    vim_free(balloonEval);
++	}
+ 	balloonEvalForTerm = FALSE;
+ # ifdef FEAT_GUI_GTK
+ 	balloonEval = gui_mch_create_beval_area(gui.drawarea, NULL,
+diff --git a/src/gui_beval.c b/src/gui_beval.c
+index 7e4625080..49694cfdd 100644
+--- a/src/gui_beval.c
++++ b/src/gui_beval.c
+@@ -111,28 +111,19 @@ gui_mch_create_beval_area(
+ 	return NULL;
+     }
+ 
+-    beval = (BalloonEval *)alloc(sizeof(BalloonEval));
++    beval = (BalloonEval *)alloc_clear(sizeof(BalloonEval));
+     if (beval != NULL)
+     {
+ #ifdef FEAT_GUI_GTK
+ 	beval->target = GTK_WIDGET(target);
+-	beval->balloonShell = NULL;
+-	beval->timerID = 0;
+ #else
+ 	beval->target = (Widget)target;
+-	beval->balloonShell = NULL;
+-	beval->timerID = (XtIntervalId)NULL;
+ 	beval->appContext = XtWidgetToApplicationContext((Widget)target);
+ #endif
+ 	beval->showState = ShS_NEUTRAL;
+-	beval->x = 0;
+-	beval->y = 0;
+ 	beval->msg = mesg;
+ 	beval->msgCB = mesgCB;
+ 	beval->clientData = clientData;
+-#ifdef FEAT_VARTABS
+-	beval->vts = NULL;
+-#endif
+ 
+ 	/*
+ 	 * Set up event handler which will keep its eyes on the pointer,
+diff --git a/src/gui_w32.c b/src/gui_w32.c
+index 855381108..147d98b39 100644
+--- a/src/gui_w32.c
++++ b/src/gui_w32.c
+@@ -8922,28 +8922,21 @@ gui_mch_create_beval_area(
+ 	return NULL;
+     }
+ 
+-    beval = (BalloonEval *)alloc(sizeof(BalloonEval));
++    beval = (BalloonEval *)alloc_clear(sizeof(BalloonEval));
+     if (beval != NULL)
+     {
+ 	beval->target = s_textArea;
+-	beval->balloon = NULL;
+ 
+ 	beval->showState = ShS_NEUTRAL;
+-	beval->x = 0;
+-	beval->y = 0;
+ 	beval->msg = mesg;
+ 	beval->msgCB = mesgCB;
+ 	beval->clientData = clientData;
+-#ifdef FEAT_VARTABS
+-	beval->vts = NULL;
+-#endif
+ 
+ 	InitCommonControls();
+ 	cur_beval = beval;
+ 
+ 	if (p_beval)
+ 	    gui_mch_enable_beval_area(beval);
+-
+     }
+     return beval;
+ }
+diff --git a/src/version.c b/src/version.c
+index a7a96b396..563a70be6 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -789,6 +789,8 @@ static char *(features[]) =
+ 
+ static int included_patches[] =
+ {   /* Add new patch number below this line */
++/**/
++    121,
+ /**/
+     119,
+ /**/
+-- 
+2.14.4
+
diff --git a/vim.spec b/vim.spec
index f149c99..2d70386 100644
--- a/vim.spec
+++ b/vim.spec
@@ -24,7 +24,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: Vim
 Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
 Source1: vim.sh
@@ -68,6 +68,9 @@ Patch3016: vim-8.0-copy-paste.patch
 # migrate shebangs in script to /usr/bin/python3 and use python2 when necessary
 Patch3017: vim-python3-tests.patch
 
+# Upstream patch:
+Patch3018: 0001-patch-8.1.0121-crash-when-using-ballooneval-related-.patch
+
 # gcc is no longer in buildroot by default
 BuildRequires: gcc
 
@@ -241,6 +244,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch3014 -p1
 %patch3016 -p1
 %patch3017 -p1
+%patch3018 -p1
 
 %build
 %if 0%{?rhel} > 7
@@ -760,6 +764,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 %{_datadir}/icons/locolor/*/apps/*
 
 %changelog
+* Wed Jul 04 2018 Ondřej Lysoněk <olysonek@redhat.com> - 2:8.1.119-4
+- Backport patch 8.1.0121: crash when using ballooneval related to 'vartabstop'
+- Resolves: rhbz#1597842
+
 * Tue Jul 03 2018 Petr Pisar <ppisar@redhat.com> - 2:8.1.119-3
 - Perl 5.28 rebuild