Bug 68766

Almost all piglit tests and most of the real world apps crash on exit, just one sample output:
./bin/glslparsertest tests/glslparsertest/shaders/CorrectConstruct.vert pass 1.10 
Successfully compiled vertex shader tests/glslparsertest/shaders/CorrectConstruct.vert: 
*** glibc detected *** ./bin/glslparsertest: double free or corruption (out): 0x00000000026f86e0 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3aee07cb3e]
/home/Paulie/graphics/install/lib64/libdricore9.3.0-devel.so.1(+0x201b2d)[0x2b6b0bb36b2d]
/home/Paulie/graphics/install/lib64/libdricore9.3.0-devel.so.1(+0x201b2d)[0x2b6b0bb36b2d]
/home/Paulie/graphics/install/lib64/libdricore9.3.0-devel.so.1(_mesa_reference_shader+0x77)[0x2b6b0ba542a7]
/home/Paulie/graphics/install/lib64/libdricore9.3.0-devel.so.1(+0x11cb77)[0x2b6b0ba51b77]
/home/Paulie/piglit/lib/libpiglitutil_gl.so(+0x800e2)[0x2ad453d400e2]
./bin/glslparsertest[0x401dd5]
./bin/glslparsertest(piglit_init+0x214)[0x4022df]
/home/Paulie/piglit/lib/libpiglitutil_gl.so(+0x7360e)[0x2ad453d3360e]
/home/Paulie/piglit/lib/libpiglitutil_gl.so(piglit_gl_test_run+0x92)[0x2ad453d31629]
./bin/glslparsertest(main+0xf6)[0x401812]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x3aee021a05]
./bin/glslparsertest[0x401659]

First bad commit:
commit df06745c5adb524e15d157f976c08f1718f08efa
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Sun Aug 25 21:38:29 2013 -0700

    i965: Allocate just enough space for user clip planes in uniform arrays.
    
    Previously, we allocated space in brw_vs_prog_data's params and
    pull_params arrays for MAX_CLIP_PLANES vec4s---even when it wasn't
    necessary.
    
    On a 64-bit architecture, this used 0.5 kB of space (8 clip planes *
    4 floats per plane * 8 bytes per float pointer * 2 arrays of pointers =
    512 bytes).  Since this cost was per-vertex shader, it added up.
    
    Conveniently, we already store the number of clip plane constants in the
    program key.  By using that, we can allocate the exact amount of space
    needed.  For the common case where user clipping is disabled, this means
    0 bytes.
    
    While we're here, mention exactly what code requires this extra space,
    since it wasn't obvious.
    
    Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Eric Anholt <eric@anholt.net>
    Reviewed-by: Paul Berry <stereotype441@gmail.com>

GPU:gm45
Mesa: f7217b99f243738f941a5d009c68387dfadcb50a
Kernel: 3.10.9-100.fc18.x86_64
Libdrm: 2.4.45-1.fc18