mesa: fc25956badb8e1932cc19d8c97b4be16e92dfc65 (master 10.2.0-devel)

This crash can still be reproduced.

(gdb) bt
#0  0x00007fa45c191a1b in _debug_assert_fail (expr=0x7fa45c2d4c69 "inst->dst.index < 4096", 
    file=0x7fa45c2d40d0 "state_tracker/st_glsl_to_tgsi.cpp", line=3245, 
    function=0x7fa45c2d5711 <glsl_to_tgsi_visitor::simplify_cmp()::__FUNCTION__> "simplify_cmp")
    at util/u_debug.c:278
#1  0x00007fa45c008a45 in glsl_to_tgsi_visitor::simplify_cmp (this=0x7fa468b89000)
    at state_tracker/st_glsl_to_tgsi.cpp:3245
#2  0x00007fa45c00f0b7 in get_mesa_program (ctx=0x7fa4398c5000, shader_program=0x7fa4234fc4b0, 
    shader=0x7fa4538c8800) at state_tracker/st_glsl_to_tgsi.cpp:5190
#3  0x00007fa45c00f7eb in st_link_shader (ctx=0x7fa4398c5000, prog=0x7fa4234fc4b0)
    at state_tracker/st_glsl_to_tgsi.cpp:5376
#4  0x00007fa45c0253ec in _mesa_glsl_link_shader (ctx=0x7fa4398c5000, prog=0x7fa4234fc4b0)
    at program/ir_to_mesa.cpp:3093
#5  0x00007fa45bf20b97 in link_program (ctx=0x7fa4398c5000, program=571) at main/shaderapi.c:913
#6  0x00007fa45bf21cd1 in _mesa_LinkProgram (programObj=571) at main/shaderapi.c:1377
#7  0x00007fa48fbe1fc1 in fLinkProgram (this=<optimized out>, program=571)
    at ../../../dist/include/GLContext.h:1315
#8  mozilla::WebGLContext::LinkProgram (this=this@entry=0x7fa41c8fd800, program=program@entry=0x7fa45b5f8380)
    at /build/buildd/firefox-28.0~b2+build1/content/canvas/src/WebGLContextGL.cpp:2129
#9  0x00007fa48f8b791b in mozilla::dom::WebGLRenderingContextBinding::linkProgram (cx=0x7fa4693bef00, obj=..., 
    self=0x7fa41c8fd800, args=...)
    at /build/buildd/firefox-28.0~b2+build1/obj-x86_64-linux-gnu/dom/bindings/WebGLRenderingContextBinding.cpp:9458
#10 0x00007fa48f8b529c in mozilla::dom::WebGLRenderingContextBinding::genericMethod (cx=0x7fa4693bef00, 
    argc=<optimized out>, vp=0x7fa4805901a8)
    at /build/buildd/firefox-28.0~b2+build1/obj-x86_64-linux-gnu/dom/bindings/WebGLRenderingContextBinding.cpp:12673
#11 0x00007fa49079d963 in CallJSNative (args=..., 
    native=0x7fa48f8b518a <mozilla::dom::WebGLRenderingContextBinding::genericMethod(JSContext*, unsigned int, JS::Value*)>, cx=0x7fa4693bef00) at /build/buildd/firefox-28.0~b2+build1/js/src/jscntxtinlines.h:220
#12 js::Invoke (cx=cx@entry=0x7fa4693bef00, args=..., construct=construct@entry=js::NO_CONSTRUCT)
    at /build/buildd/firefox-28.0~b2+build1/js/src/vm/Interpreter.cpp:463
#13 0x00007fa490790bc0 in Interpret (cx=cx@entry=0x7fa4693bef00, state=...)
    at /build/buildd/firefox-28.0~b2+build1/js/src/vm/Interpreter.cpp:2511
#14 0x00007fa49079d61d in js::RunScript (cx=cx@entry=0x7fa4693bef00, state=...)
    at /build/buildd/firefox-28.0~b2+build1/js/src/vm/Interpreter.cpp:420
#15 0x00007fa49079d86a in js::Invoke (cx=cx@entry=0x7fa4693bef00, args=..., 
    construct=construct@entry=js::NO_CONSTRUCT)
    at /build/buildd/firefox-28.0~b2+build1/js/src/vm/Interpreter.cpp:482
#16 0x00007fa49079ddcd in js::Invoke (cx=cx@entry=0x7fa4693bef00, thisv=..., fval=..., argc=0, 
    argv=<optimized out>, rval=...) at /build/buildd/firefox-28.0~b2+build1/js/src/vm/Interpreter.cpp:519
#17 0x00007fa49068ec77 in JS_CallFunctionValue (cx=cx@entry=0x7fa4693bef00, objArg=<optimized out>, fval=..., 
    argc=argc@entry=0, argv=<optimized out>, rval=rval@entry=0x7fff4efbe420)
    at /build/buildd/firefox-28.0~b2+build1/js/src/jsapi.cpp:5001
#18 0x00007fa48f722786 in mozilla::dom::Function::Call (this=this@entry=0x7fa425af6140, cx=0x7fa4693bef00, 
    aThisObj=..., aThisObj@entry=..., arguments=..., aRv=...)
    at /build/buildd/firefox-28.0~b2+build1/obj-x86_64-linux-gnu/dom/bindings/FunctionBinding.cpp:35
#19 0x00007fa48fa417b8 in mozilla::dom::Function::Call<nsCOMPtr<nsISupports> > (
    this=this@entry=0x7fa425af6140, thisObj=..., arguments=..., aRv=...,     aExceptionHandling=aExceptionHandling@entry=mozilla::dom::CallbackObject::eReportExceptions)
    at ../../dist/include/mozilla/dom/FunctionBinding.h:55
#20 0x00007fa48fa418f4 in nsGlobalWindow::RunTimeoutHandler (this=this@entry=0x7fa42aaf6000, 
    aTimeout=aTimeout@entry=0x7fa4487723c0, aScx=<optimized out>)
    at /build/buildd/firefox-28.0~b2+build1/dom/base/nsGlobalWindow.cpp:11723
#21 0x00007fa48fa42137 in nsGlobalWindow::RunTimeout (this=0x7fa42aaf6000, aTimeout=0x7fa4487723c0)
    at /build/buildd/firefox-28.0~b2+build1/dom/base/nsGlobalWindow.cpp:11947
#22 0x00007fa48fa42336 in nsGlobalWindow::TimerCallback (aTimer=<optimized out>, aClosure=<optimized out>)
    at /build/buildd/firefox-28.0~b2+build1/dom/base/nsGlobalWindow.cpp:12193
#23 0x00007fa48f2e11ec in nsTimerImpl::Fire (this=0x7fa46a15fb50)
    at /build/buildd/firefox-28.0~b2+build1/xpcom/threads/nsTimerImpl.cpp:551
#24 0x00007fa48f2e12a7 in nsTimerEvent::Run (this=0x7fa45c328ea2)
    at /build/buildd/firefox-28.0~b2+build1/xpcom/threads/nsTimerImpl.cpp:635
#25 0x00007fa48f2deec4 in nsThread::ProcessNextEvent (this=0x7fa493328c00, mayWait=<optimized out>, 
    result=0x7fff4efbe8df) at /build/buildd/firefox-28.0~b2+build1/xpcom/threads/nsThread.cpp:612
#26 0x00007fa48f2a310c in NS_ProcessNextEvent (thread=<optimized out>, mayWait=mayWait@entry=false)
    at /build/buildd/firefox-28.0~b2+build1/xpcom/glue/nsThreadUtils.cpp:263
#27 0x00007fa48f45c0b4 in mozilla::ipc::MessagePump::Run (this=0x7fa484b58140, aDelegate=0x7fa49335f360)
    at /build/buildd/firefox-28.0~b2+build1/ipc/glue/MessagePump.cpp:85
#28 0x00007fa48f45094d in RunHandler (this=0x7fa49335f360)
    at /build/buildd/firefox-28.0~b2+build1/ipc/chromium/src/base/message_loop.cc:215
#29 MessageLoop::Run (this=0x7fa49335f360)
    at /build/buildd/firefox-28.0~b2+build1/ipc/chromium/src/base/message_loop.cc:189
#30 0x00007fa48f981691 in nsBaseAppShell::Run (this=0x7fa480589a90)
    at /build/buildd/firefox-28.0~b2+build1/widget/xpwidgets/nsBaseAppShell.cpp:161
#31 0x00007fa4901f9f2e in nsAppStartup::Run (this=0x7fa480535060)
    at /build/buildd/firefox-28.0~b2+build1/toolkit/components/startup/nsAppStartup.cpp:276
#32 0x00007fa4901bdfa5 in XREMain::XRE_mainRun (this=this@entry=0x7fff4efbeb50)
    at /build/buildd/firefox-28.0~b2+build1/toolkit/xre/nsAppRunner.cpp:4059
#33 0x00007fa4901be225 in XREMain::XRE_main (this=this@entry=0x7fff4efbeb50, argc=argc@entry=1, 
    argv=argv@entry=0x7fff4efc0048, aAppData=aAppData@entry=0x7fff4efbed50)
    at /build/buildd/firefox-28.0~b2+build1/toolkit/xre/nsAppRunner.cpp:4127
#34 0x00007fa4901be48a in XRE_main (argc=1, argv=0x7fff4efc0048, aAppData=0x7fff4efbed50, 
    aFlags=<optimized out>) at /build/buildd/firefox-28.0~b2+build1/toolkit/xre/nsAppRunner.cpp:4337
#35 0x00007fa4946413c1 in do_main (argc=1, argv=0x7fff4efc0048, xreDirectory=0x7fa49332c6c0)
    at /build/buildd/firefox-28.0~b2+build1/browser/app/nsBrowserApp.cpp:280
#36 0x00007fa494640b7c in main (argc=1, argv=0x7fff4efc0048)
    at /build/buildd/firefox-28.0~b2+build1/browser/app/nsBrowserApp.cpp:648
(gdb) frame 1
#1  0x00007fa45c008a45 in glsl_to_tgsi_visitor::simplify_cmp (this=0x7fa468b89000)
    at state_tracker/st_glsl_to_tgsi.cpp:3245
3245	         assert(inst->dst.index < MAX_TEMPS);
(gdb) print inst->dst.index
$1 = 4096

Created attachment 105171 [details]
shaders reproducing the issue

I'm still hitting this bug when running some game (miasmata) in wine
src/mesa/state_tracker/st_glsl_to_tgsi.cpp:3333:simplify_cmp: Assertion `inst->dst.index < 4096' failed.
This is with a nve6 (gtx660) on nouveau.
imirkin on #nouveau claims the attached shaders reproduce the issue.

Fixed by 482def592fede9c4c2f1e6944df42e8319dd6b78. Closing.