There is a patch in ubuntu:
+From ca4d405b1087c30a1bd764937dbc0b66b0473032 Mon Sep 17 00:00:00 2001
+From: Martin Pitt <email address hidden>
+Date: Tue, 23 Mar 2010 12:47:59 +0100
+Subject: [PATCH 2/2] Keep multiple system keyboard layouts for session
This patch contains one serious bug:
++ config->layouts = g_new0 (char *, g_strv_length (initial_config->layouts) + 2);
++ config->variants = g_new0 (char *, g_strv_length (initial_config->variants) + 2);
In case you have 2 layouts and variants are not specified (I got that scenario), you will allocate 4 and 2 elements correspondingly. This is clearly wrong - because later you'll assign 3 variants. Then gdm-greeter crashes inside xklavier (memory corruption).
The correct code should have
config->variants = g_new0 (char *, g_strv_length (initial_config->layouts) + 2);
This is gdm crasher, so please fix it ASAP.
I was actually aware of this inconsistency back then, but I never managed to get a situation where the variants list had a different length than the layouts lists -- how can this be reproduced?