Comment 12 for bug 685785

@Chris - It looks like your hypothesis was correct.

I've rebuilt gnome-settings-daemon with DEB_BUILD_OPTIONS="noopt nostrip" to get a full stack trace, and filed a new crash report as bug 692149. Here's the popup_menu_set_group stack frame showing group_number > g:

#5 0x00007f4cb00667b0 in popup_menu_set_group (item=0x0, param=0x2) at gsd-keyboard-xkb.c:391
        shortnames = 0x1f8ef70
        lname = 0x1f8f050 "USA"
        ln2cnt_map = 0x1f8f9e0
        guide = 0x7f4cb006a507 "XXX"
        longnames = 0x1f8f0c0
        layout_name = 0x1 <Address 0x1 out of bounds>
        group_number = 2
        engine = 0x1650f80
        st = 0x165ba4c
        cur = 96469911
        __func__ = "popup_menu_set_group"
        xklrec = 0x1f16900
        registry = 0x1f8f2e0
        g = 1