System Environment:
--------------------------

--Platform: i965

--Architecture(32-bit,64-bit,compatiblity): all

--2D driver:
commit a1cd37f94cb8efbde84ba0a46839fb8735dd3595

--3D driver:
commit 20e0a8a1ca8e526f4b9b5e6043456c5aeb8fbc0f

--Xserver:
commit 01c2e01f2aee580438b74bfb9da8f584f3878e6b

--Drm
commit 07ba3b7193f1a50c3ef0509f9e37dab41457f81b

--Kernel:
2.6.23.1


Bug detailed description:
-------------------------
this issue does not happen on i915.
this issue does not happen in software rendering mode.
run mesa/demos/shadowtex will abort with following backtrace:
(gdb) bt
#0  0x0000003a38c30ec5 in raise () from /lib64/libc.so.6
#1  0x0000003a38c32970 in abort () from /lib64/libc.so.6
#2  0x0000003a38c2a11f in __assert_fail () from /lib64/libc.so.6
#3  0x00002b8748f26248 in upload_wm_surfaces (brw=0x6161a0) at brw_wm_surface_state.c:137
#4  0x00002b8748f0a4ca in brw_validate_state (brw=0x6161a0) at brw_state_upload.c:258
#5  0x00002b8748efda87 in brw_draw_prims (ctx=<value optimized out>, arrays=0x6535a0, prim=0x651d84, nr_prims=15, ib=0x0,
    min_index=0, max_index=449) at brw_draw.c:300
#6  0x00002b8748fa20ec in vbo_exec_vtx_flush (exec=0x651b40) at vbo/vbo_exec_draw.c:215
#7  0x00002b8748f9d841 in vbo_exec_FlushVertices (ctx=<value optimized out>, flags=23309) at vbo/vbo_exec_api.c:700
#8  0x00002b8748f5f6c1 in _mesa_PopMatrix () at main/matrix.c:274
#9  0x00002b8747d50e0f in glPopMatrix () at ../../../src/mesa/glapi/glapitemp.h:1570
#10 0x0000000000402d84 in DrawScene () at shadowtex.c:224
#11 0x000000000040363a in Display () at shadowtex.c:647
#12 0x00002b8747a50ea4 in processWindowWorkList (window=0x60b3e0) at glut_event.c:1306
#13 0x00002b8747a519e2 in glutMainLoop () at glut_event.c:1353
#14 0x0000000000402689 in main (argc=1, argv=0x7fff63079758) at shadowtex.c:1036




Reproduce steps:
----------------
1. start X
2. run mesa/demos/shadowtex


Current result:
----------------
mesa/demos/shadowtex abort


Expected result:
----------------
mesa/demos/shadowtex should run without abort