@Chris - It looks like your hypothesis was correct. I've rebuilt gnome-settings-daemon with DEB_BUILD_OPTIONS="noopt nostrip" to get a full stack trace, and filed a new crash report as bug 692149. Here's the popup_menu_set_group stack frame showing group_number > g:
#5 0x00007f4cb00667b0 in popup_menu_set_group (item=0x0, param=0x2) at gsd-keyboard-xkb.c:391 shortnames = 0x1f8ef70 lname = 0x1f8f050 "USA" ln2cnt_map = 0x1f8f9e0 guide = 0x7f4cb006a507 "XXX" longnames = 0x1f8f0c0 layout_name = 0x1 <Address 0x1 out of bounds> group_number = 2 engine = 0x1650f80 st = 0x165ba4c cur = 96469911 __func__ = "popup_menu_set_group" xklrec = 0x1f16900 registry = 0x1f8f2e0 g = 1 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/685785 Title: gnome-settings-daemon crashed with SIGSEGV in __libc_free() -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs