Comment 5 for bug 573099

Excerpt from :1-greeter.log, with approximate translation:

Window Manager Warning : Reading saved session file /var/lib/gdm/.config/metacity/sessions/1060c6d4bc3fbbceca127272763347355200000043090007.ms failed: Opening filr/ "var/lib/gdm/.config/metacity/sessions/1060c6d4bc3fbbceca127272763347355200000043090007.ms" failed: No siuch file or directory.
gdm-simple-greeter[4321]: Gtk-WARNING: /build/buildd/gtk+2.0-2.20.0/gtk/gtkwidget.c:5636: widget not within a GtkWindow
Window Manager Warning : Buggy client sent a _NET_ACTIVE_WINDOW message with a timestamp of 0 for 0x1000046 (Window d)
Window Manager Warnin : meta_window_activate called by a pager with a 0 timestamp; the pager needs to be fixed.
Window Manager Warnin : Buggy client sent a _NET_ACTIVE_WINDOW message with a timestamp of 0 for 0x1000046 (Window d)
Window Manager Warnin: meta_window_activate called by a pager with a 0 timestamp; the pager needs to be fixed.
*** glibc detected *** /usr/lib/gdm/gdm-simple-greeter: double free or corruption (out): 0x0948eca0 ***
[trace message]

And from gdb trace:
[glibc error handling]
#12 0x0104049d in __libc_message (do_abort=2,
    fmt=0x1114f58 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#13 0x0104a591 in malloc_printerr (action=<value optimized out>,
    str=0x6 <Address 0x6 out of bounds>, ptr=0x948eca0) at malloc.c:6264
#14 0x0104bde8 in _int_free (av=<value optimized out>, p=<value optimized out>)
    at malloc.c:4792
#15 0x0104eecd in *__GI___libc_free (mem=0x948eca0) at malloc.c:3738
#16 0x00dddfc6 in IA__g_free (mem=0x948eca0)
    at /build/buildd/glib2.0-2.24.0/glib/gmem.c:191
#17 0x0805c714 in ?? ()
#18 0x0052bf6c in gtk_tree_model_sort_level_find_insert (
    tree_model_sort=0xbfa9fcd0, level=<value optimized out>, iter=0xbfa9fcd0,
    skip_index=3) at /build/buildd/gtk+2.0-2.20.0/gtk/gtktreemodelsort.c:1818
#19 0x0052e298 in gtk_tree_model_sort_insert_value (s_model=0x93a61b0,
    s_path=0x948ec80, s_iter=0x9485cd0, data=0x93ead00)
    at /build/buildd/gtk+2.0-2.20.0/gtk/gtktreemodelsort.c:1863
#20 gtk_tree_model_sort_row_inserted (s_model=0x93a61b0, s_path=0x948ec80,
    s_iter=0x9485cd0, data=0x93ead00)
    at /build/buildd/gtk+2.0-2.20.0/gtk/gtktreemodelsort.c:674
#21 0x0043872f in _gtk_marshal_VOID__BOXED_BOXED (closure=0x9504f40,
    return_value=0x0, n_param_values=3, param_values=0x95279c8,
    invocation_hint=0xbfa9fe60, marshal_data=0x52dfb0)
    at /build/buildd/gtk+2.0-2.20.0/gtk/gtkmarshalers.c:1309
#22 0x00e9f252 in IA__g_closure_invoke (closure=0x9504f40, return_value=0x0,
    n_param_values=3, param_values=0x95279c8, invocation_hint=0xbfa9fe60)
    at /build/buildd/glib2.0-2.24.0/gobject/gclosure.c:767
#23 0x00eb399d in signal_emit_unlocked_R (node=<value optimized out>,
    detail=<value optimized out>, instance=0x93a61b0, emission_return=0x0,
    instance_and_params=0x95279c8)
    at /build/buildd/glib2.0-2.24.0/gobject/gsignal.c:3248
[signals, main loop...]
#51 0x00ff5bd6 in __libc_start_main (main=0x8054f20, argc=1,
    ubp_av=0xbfaa0c14, init=0x807e300, fini=0x807e2f0,
    rtld_fini=0x9e40c0 <_dl_fini>, stack_end=0xbfaa0c0c) at libc-start.c:226
#52 0x08054e81 in ?? ()

So is #17 the missing GDM call, or is the bug happening in Gtk+ itself? How can I help debugging this?