I have just tried it here and it didn't crash. Could you please re-test the game on your machine?

It's still crashing on the same line.

But I just noticed that I get the same crash in softpipe and llvmpipe, so I guess this bug should be reassigned to Mesa core?

Yeah, reassigning to Mesa core.

In gdb:

(gdb) print index

(gdb) print t->outputMapping[index]

(gdb) print t->outputs

thanks.

I'm not sure if it's important, but the crash isn't reproducible  if --enable-debug is used. This is from a run with optimisations turned off through CFLAGS (values are optimised out otherwise).

(gdb) print index
$1 = 2
(gdb) print t->outputMapping[index]
$2 = 2228224
(gdb) print t->outputs
$3 = {{File = 0, WriteMask = 0, Indirect = 0, Saturate = 0, Predicate = 0, 
    PredNegate = 0, PredSwizzleX = 0, PredSwizzleY = 0, PredSwizzleZ = 0, 
    PredSwizzleW = 0, Index = 0, IndirectIndex = 0, 
    IndirectSwizzle = 0} <repeats 32 times>}

Can you provide more debugging info?  After the program crashes in gdb, please do:

(gdb) up
(gdb) call _mesa_print_program(program)

With git from today (290a114) I can't reproduce the crash if the game is launched by gdb, only by attaching after it's started.

I also had to move up three frames in the stack to be able to call _mesa_print_program(program) (but maybe that's self-explanatory?).

Anyway: 

# Fragment Program/Shader 0
  0: MAD_SAT TEMP[1].x, INPUT[3].xxxx, STATE[0].xxxx, STATE[0].yyyy;
  1: LRP OUTPUT[2].xyz, TEMP[1].xxxx, TEMP[0], STATE[1];
  2: MOV OUTPUT[2].w, TEMP[0];
  3: END

Mesa commit 2fa6012f6a0b02de6093cbccba3bf4432f072e57 may have fixed this.  Can you retest?

Just tried git master, it's working fine now!