I and Ross looked on the checkcast_arraycopy stub's code
and we found the bug - 2 arguments use the same register:

2399     array_store_check(O1_to, O2_count, O2);   // store check on O1[0..O2]

array_store_check(Register addr, Register count, Register tmp) {
...

1082       __ sub(count, addr, count);
1083     assert( tmp != addr, "need separate temp reg");
1084     Address rs(tmp, (address)ct->byte_map_base);
1085       __ load_address(rs);

The 'count' is destroyed when Address rs is created:

0xfc439828:     sub      %o2, %o1, %o2
0xfc43982c:     sethi    %hi(0xfbac2000), %o2
0xfc439830:     inc      0, %o2
0xfc439834:     clrb     [%o2 + %o1]
0xfc439838:     deccc    %o2
0xfc43983c:     bge,pt   %icc,0xfc439834        ! 0xfc439834
0xfc439840:     inc      %o1
0xfc439844:     retl

We are lucky when ct->byte_map_base address is negative as
in the code above. Other problem: card marks were not done.

But in Tim's case, it seems, ct->byte_map_base address is positive:

The loopy thread stack looks like this:

----------------- t@2 -----------------
0x7c839834    <StubRoutines>
0x7c94e8e8    0x7c94e8e8    * com.sun.java.util.jar.pack.ConstantPool.partition(com.sun.java.util.jar.pack.ConstantPool$Index, int[]) bci:201 line:922 (Compiled frame; information may be imprecise)
Tim Bell wrote:
> The loop is very tight:
>
> 0x7c839834:     clrb     [%o2 + %o1]
> 0x7c839838:     deccc    %o2
> 0x7c83983c:     bge,pt   %icc,0x7c839834        ! 0x7c839834
> 0x7c839840:     inc      %o1
>
>
> (dbx) where
> current thread: t@2
>   [1] 0x7c839834(0x0, 0x7abea9b9, 0x3e866a6, 0x20, 0x5824cf48, 0x4), at 0x7c839834
>   [2] 0x7c9d2df0(0x7620be70, 0x7620bf20, 0x75d77128, 0xffffcca3, 0x7e6c0000, 0x7620bea0), at 0x7c9d2df0
>   [...snip...]
>
> (dbx)  print -fx $pc
> $pc = 0x7c839834
>
> (dbx) regs
> current thread: t@2
> current frame:  [1]
> g0-g3    0x00000000 0x00000000 0x0002f800 0x60dedba8
> g4-g7    0x5825b0c0 0x5824cf48 0x00000000 0x7fb62400
> o0-o3    0x00000000 0x7abea9b9 0x03e866a6 0x00000020
> o4-o7    0x5824cf48 0x00000004 0x7ed7f528 0x7c9d2df0
> l0-l3    0x58071d40 0x00000000 0x00000000 0x00000001
> l4-l7    0x75d77140 0x7e6c0000 0x7620bf70 0x0002f800
> i0-i3    0x7620be70 0x7620bf20 0x75d77128 0xffffcca3
> i4-i7    0x7e6c0000 0x7620bea0 0x7ed7f590 0x7c94e8e8
> y        0x00000000
> ccr      0x00000000
> pc       0x7c839834:0x7c839834  clrb     [%o2 + %o1]
> npc      0x7c839838:0x7c839838  deccc    %o2
>
>
> (dbx) dis __1cMStubRoutinesU_checkcast_arraycopy_/50
> 0x7c839780:     addcc    %o2, 0, %g1
> 0x7c839784:     bne,pt   %icc,0x7c8397b0        ! 0x7c8397b0
> 0x7c839788:     clr      %o5
> 0x7c83978c:     retl
> 0x7c839790:     clr      %o0
> 0x7c839794:     nop
> 0x7c839798:     nop
> 0x7c83979c:     nop
> 0x7c8397a0:     st       %g3, [%o1 + %o5]
> 0x7c8397a4:     inc      4, %o5
> 0x7c8397a8:     be,a,pt  %icc,0x7c839814        ! 0x7c839814
> 0x7c8397ac:     clr      %o0
> 0x7c8397b0:     ld       [%o0 + %o5], %g3
> 0x7c8397b4:     tst      %g3
> 0x7c8397b8:     be,a,pt  %icc,0x7c8397a0        ! 0x7c8397a0
> 0x7c8397bc:     deccc    %g1
> 0x7c8397c0:     ld       [%g3 + 4], %g4
> 0x7c8397c4:     cmp      %g4, %o4
> 0x7c8397c8:     be,a,pt  %icc,0x7c8397a0        ! 0x7c8397a0
> 0x7c8397cc:     deccc    %g1
> 0x7c8397d0:     ld       [%g4 + %o3], %g5
> 0x7c8397d4:     cmp      %o4, %g5
> 0x7c8397d8:     be,a,pt  %icc,0x7c8397a0        ! 0x7c8397a0
> 0x7c8397dc:     deccc    %g1
> 0x7c8397e0:     cmp      %o4, 20
> 0x7c8397e4:     bne,a,pt  %icc,0x7c839808       ! 0x7c839808
> 0x7c8397e8:     nop
> 0x7c8397ec:     save     %sp, -96, %sp
> 0x7c8397f0:     mov      %g4, %o1
> 0x7c8397f4:     call     0x7c800720     ! 0x7c800720
> 0x7c8397f8:     mov      %i4, %o2
> 0x7c8397fc:     restore
> 0x7c839800:     be,a,pt  %icc,0x7c8397a0        ! 0x7c8397a0
> 0x7c839804:     deccc    %g1
> 0x7c839808:     subcc    %o2, %g1, %o2
> 0x7c83980c:     be,pt    %icc,0x7c839844        ! 0x7c839844
> 0x7c839810:     not      %o2, %o0
> 0x7c839814:     sll      %o2, 2, %o2
> 0x7c839818:     dec      4, %o2
> 0x7c83981c:     add      %o2, %o1, %o2
> 0x7c839820:     srl      %o1, 9, %o1
> 0x7c839824:     srl      %o2, 9, %o2
> 0x7c839828:     sub      %o2, %o1, %o2
> 0x7c83982c:     sethi    %hi(0x7e6c0000), %o2
> 0x7c839830:     inc      0, %o2
> 0x7c839834:     clrb     [%o2 + %o1]
> 0x7c839838:     deccc    %o2
> 0x7c83983c:     bge,pt   %icc,0x7c839834        ! 0x7c839834
> 0x7c839840:     inc      %o1
> 0x7c839844:     retl
>