Customer is having JVM crashes.  A run with java_g is used to flush out the culprit and this is what we hit.

(dbx) where
  [1] __lwp_kill(0x0, 0x6, 0x0, 0xff33c000, 0x0, 0x0), at 0xff31e71c
  [2] raise(0x6, 0x0, 0xfb0ff530, 0x7efefeff, 0x81010100, 0xff00), at 0xff2cd754
  [3] abort(0xfb0ff5d8, 0xfee3624e, 0xfee3624b, 0x4, 0x81010100, 0xff00), at 0xff2b69e8
=>[4] os::abort(dump_core = 1), line 1345 in "os_solaris.cpp"
  [5] VMError::report_and_die(this = 0xfb0ff780), line 705 in "vmError.cpp"
  [6] report_assertion_failure(file_name = 0xfee69a81 "/export1/jdk142-update/ws/fcs/hotspot/src/share/vm/memory/referenceProcessor.cpp", line_no = 347, message = 0xfee69ad2 "assert(referent->is_oop(),"Adding a bad referent")"), line 211 in "debug.cpp"
  [7] ReferenceProcessor::process_discovered_reflist(this = 0xe5094, refs_list_addr = 0xe50ac, policy = (nil), clear_referent = 0, is_alive = 0xfb0ffa4c, keep_alive = 0xfb0ffa2c, complete_gc = 0xfb0ffa0c), line 347 in "referenceProcessor.cpp"
  [8] ReferenceProcessor::process_discovered_references(this = 0xe5094, policy = 0x11d3d4, is_alive = 0xfb0ffa4c, keep_alive = 0xfb0ffa2c, complete_gc = 0xfb0ffa0c), line 192 in "referenceProcessor.cpp"
  [9] CMSCollector::refProcessingWork(this = 0x10cbb0, asynch = 1, clear_all_soft_refs = 0), line 3453 in "concurrentMarkSweepGeneration.cpp"
  [10] CMSCollector::checkpointRootsFinalWork(this = 0x10cbb0, asynch = 1, clear_all_soft_refs = 0, init_mark_was_synchronous = 0), line 3068 in "concurrentMarkSweepGeneration.cpp"
  [11] CMSCollector::checkpointRootsFinal(this = 0x10cbb0, asynch = 1, clear_all_soft_refs = 0, init_mark_was_synchronous = 0), line 3008 in "concurrentMarkSweepGeneration.cpp"
  [12] CMSCollector::do_CMS_operation(this = 0x10cbb0, op = CMS_op_checkpointRootsFinal), line 3775 in "concurrentMarkSweepGeneration.cpp"
  [13] CMSCollector::stop_world_and_do(this = 0x10cbb0, op = CMS_op_checkpointRootsFinal), line 3865 in "concurrentMarkSweepGeneration.cpp"
  [14] CMSCollector::collect_in_background(this = 0x10cbb0, clear_all_soft_refs = 0), line 1759 in "concurrentMarkSweepGeneration.cpp"
  [15] ConcurrentMarkSweepThread::run(this = 0x11d2b0), line 107 in "concurrentMarkSweepThread.cpp"
  [16] java_start(thread_addr = 0x11d2b0), line 733 in "os_solaris.cpp"

Relevant flags used are
argv[15]: -XX:SuppressErrorAt=concurrentMarkSweepThread.hpp:149
argv[16]: -XX:+UseParNewGC
argv[17]: -XX:+UseConcMarkSweepGC
argv[18]: -XX:MaxNewSize=32m
argv[19]: -XX:NewSize=32m
argv[20]: -Xms448m
argv[21]: -Xmx448m
argv[22]: -XX:SurvivorRatio=128
argv[23]: -XX:MaxTenuringThreshold=0
argv[24]: -XX:CMSInitiatingOccupancyFraction=60
argv[25]: -Dsun.rmi.dgc.server.gcInterval=0x7FFFFFFFFFFFFFFE
argv[26]: -Dsun.rmi.dgc.client.gcInterval=0x7FFFFFFFFFFFFFFE
argv[27]: -XX:+DisableExplicitGC
argv[28]: -XX:+UseTLAB
argv[29]: -XX:+CMSIncrementalMode
argv[30]: -XX:+CMSIncrementalPacing
argv[31]: -XX:CMSIncrementalDutyCycleMin=0
argv[32]: -XX:CMSIncrementalDutyCycle=10
argv[33]: -XX:CodeCacheMinimumFreeSpace=4M
argv[34]: -XX:ReservedCodeCacheSize=128M