[naga] panic when array override value already in arena

[sagudev]

Description
First reported in #6635 (comment), naga panic when array override value already in arena.

backtrace:

assertion failed: added && index == self.set.len() - 1 (thread WGPU, at /home/user/.cargo/git/checkouts/wgpu-53e70f8674b08dd4/8f82992/naga/src/arena/unique_arena.rs:153)
   0: servoshell::backtrace::print
   1: servoshell::panic_hook::panic_hook
   2: std::panicking::rust_panic_with_hook
   3: std::panicking::begin_panic_handler::{{closure}}
   4: std::sys::backtrace::__rust_end_short_backtrace
   5: rust_begin_unwind
   6: core::panicking::panic_fmt
   7: core::panicking::panic
   8: naga::arena::unique_arena::UniqueArena<T>::replace
   9: naga::back::pipeline_constants::process_overrides
  10: wgpu_hal::vulkan::device::<impl wgpu_hal::vulkan::Device>::compile_stage
  11: <D as wgpu_hal::dynamic::device::DynDevice>::create_compute_pipeline
  12: webgpu::wgpu_thread::WGPU::run

Repro steps

Observed when running webgpu:shader,execution,limits:workgroup_array_byte_size_override:* in servo, but one can also patch wgpu test to expose this behaviour:

diff --git a/tests/tests/shader/array_size_overrides.rs b/tests/tests/shader/array_size_overrides.rs
index 7f1d32425..476e414c7 100644
--- a/tests/tests/shader/array_size_overrides.rs
+++ b/tests/tests/shader/array_size_overrides.rs
@@ -9,7 +9,7 @@ const SHADER: &str = r#"
     var<workgroup> arr: array<u32, n - 2>;
 
     @group(0) @binding(0)
-    var<storage, read_write> output: array<u32>;
+    var<storage, read_write> output: array<u32, 14 - 2>;

     @compute @workgroup_size(1) fn main() {
         // 1d spiral
@@ -34,9 +34,9 @@ const SHADER: &str = r#"
 static ARRAY_SIZE_OVERRIDES: GpuTestConfiguration = GpuTestConfiguration::new()
     .parameters(TestParameters::default().limits(wgpu::Limits::default()))
     .run_async(move |ctx| async move {
-        array_size_overrides(&ctx, None, &[534], false).await;
+        //array_size_overrides(&ctx, None, &[534], false).await;
         array_size_overrides(&ctx, Some(14), &[286480122], false).await;
-        array_size_overrides(&ctx, Some(1), &[0], true).await;
+        //array_size_overrides(&ctx, Some(1), &[0], true).await;
     });

 async fn array_size_overrides(

[kentslaney]

Thanks for filing, I'll look into it now