I am looking into this

We are not checking out-of-bounds accesses into the pull_constant_loc array.
I sent a patch for review that fixes this:
http://lists.freedesktop.org/archives/mesa-dev/2015-March/079009.html

BTW, this is the error that gets fixed, as reported by Valgrind:

==18969== Invalid read of size 4
==18969==    at 0xA8FA80D: fs_visitor::demote_pull_constants() (brw_fs.cpp:1966)
==18969==    by 0xA8FDEAB: fs_visitor::run() (brw_fs.cpp:3044)
==18969==    by 0xA8FE3BB: brw_wm_fs_emit (brw_fs.cpp:3169)
==18969==    by 0xA97E219: do_wm_prog (brw_wm.c:183)
==18969==    by 0xA8FEC88: brw_fs_precompile(gl_context*, gl_shader_program*) (brw_fs.cpp:3294)
==18969==    by 0xA93F2BA: brw_shader_precompile(gl_context*, gl_shader_program*) (brw_shader.cpp:72)
==18969==    by 0xA93FB51: brw_link_shader (brw_shader.cpp:274)
==18969==    by 0xA7B03C7: _mesa_glsl_link_shader (ir_to_mesa.cpp:3092)
==18969==    by 0xA64AC43: link_program (shaderapi.c:915)
==18969==    by 0xA64BDC4: _mesa_LinkProgram (shaderapi.c:1383)
==18969==    by 0x81DA11E: shared_dispatch_stub_509 (glapi_mapi_tmp.h:17831)
==18969==    by 0x4EDE27D: stub_glLinkProgram (piglit-dispatch-gen.c:31514)

Fixed with:

commit 6ac1bc90c4a7a6f32901a9782e14b090f6fe5270
Author: Iago Toral Quiroga <itoral@igalia.com>
Date:   Tue Mar 10 11:36:43 2015 +0100

    i965: Fix out-of-bounds accesses into pull_constant_loc array
    
    The piglit test glsl-fs-uniform-array-loop-unroll.shader_test was designed
    to do an out of bounds access into an uniform array to make sure that we
    handle that situation gracefully inside the driver, however, as Ken describes
    in bug 79202, Valgrind reports that this is leading to an out-of-bounds access
    in fs_visitor::demote_pull_constants().
    
    Before accessing the pull_constant_loc array we should make sure that
    the uniform we are trying to access is valid.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=79202
    Reviewed-by: Matt Turner <mattst88@gmail.com>