6u14 server vm crashed with SEGV when -XX:-UseBiasedLocking was used.
RHEL5, 6u14 x64 + JBoss 4.3.

// hs_err_pid13981.log:
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x0000002a96656d44, pid=13981, tid=1209604448
#
# JRE version: 6.0_14-b08
# Java VM: Java HotSpot(TM) 64-Bit Server VM (14.0-b16 mixed mode linux-amd64 )
# Problematic frame:
# j  java.lang.Object.notifyAll()V+0
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread (0x0000002addacfff0):  JavaThread "http-0.0.0.0-8080-881" daemon [_thread_i
n_native_trans, id=18989, stack(0x0000000048171000,0x0000000048192000)]

siginfo:si_signo=SIGSEGV: si_errno=0, si_code=2 (SEGV_ACCERR), si_addr=0x0000002a962e9000

Registers:
RAX=0x0000000000000000, RBX=0x0000002acdf17890, RCX=0x0000002a95f600d8, RDX=0x000000000000
0004
RSP=0x00000000481909a0, RBP=0x0000000048190a08, RSI=0x0000002addad07a8, RDI=0x0000002a95f4
a933
R8 =0x0000000000000ffc, R9 =0x0000002a962e8000, R10=0x0000002a962e8000, R11=0x000000000000
0ffc
R12=0x0000002addacfff0, R13=0x0000002acdf17890, R14=0x0000000048190a28, R15=0x0000002addac
fff0
RIP=0x0000002a96656d44, EFL=0x0000000000010206, CSGSFS=0x0000000000000000, ERR=0x000000000
0000007
  TRAPNO=0x000000000000000e

Instructions: (pc=0x0000002a96656d44)
0x0000002a96656d34:   81 e3 fc 0f 00 00 49 ba 00 80 2e 96 2a 00 00 00
0x0000002a96656d44:   4f 89 1c 1a 81 3d 86 93 90 ff 00 00 00 00 0f 85

0000002a96656d34 81 e3 fc 0f 00 00       and    $0xffc,%ebx
0000002a96656d3a 49 ba 00 80 2e 96 2a 00 00 00 mov    $0x2a962e8000,%r10
---------------
0000002a96656d44 4f 89 1c 1a             mov    %r11,(%r10,%r11,1) <<< SEGV
0000002a96656d48 81 3d 86 93 90 ff 00 00 00 00 cmpl   $0x0,-7302266(%rip)        # 0xffffffff95f600d8
0000002a96656d52 0f 85 ff ff ff ff       jne    0xffffffff96656d57

; R10=0x0000002a962e8000, R11=0x0000000000000ffc
// still I don't see SA for 6, so can't get much from core.

Stack: [0x0000000048171000,0x0000000048192000],  sp=0x00000000481909a0,  free space=126k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
j  java.lang.Object.notifyAll()V+0
j  org.apache.tomcat.util.net.JIoEndpoint$Worker.await()Ljava/net/Socket;+29
j  org.apache.tomcat.util.net.JIoEndpoint$Worker.run()V+11
j  java.lang.Thread.run()V+11
v  ~StubRoutines::call_stub
V  [libjvm.so+0x3a8e7d]
V  [libjvm.so+0x595e79]
V  [libjvm.so+0x3a874c]
V  [libjvm.so+0x3a87fb]
V  [libjvm.so+0x433707]
V  [libjvm.so+0x67b871]
V  [libjvm.so+0x596f9f]
C  [libpthread.so.0+0x6137]
C  0x0000000000000000

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  java.lang.Object.notifyAll()V+0
j  org.apache.tomcat.util.net.JIoEndpoint$Worker.await()Ljava/net/Socket;+29
j  org.apache.tomcat.util.net.JIoEndpoint$Worker.run()V+11
j  java.lang.Thread.run()V+11
v  ~StubRoutines::call_stub
:
VM Arguments:
jvm_args: -Dprogram.name=run.sh -XX:-UseBiasedLocking -Xmn256m -Xms840m -Xmx840m -Xss128k
-XX:PermSize=128m -XX:MaxPermSize=128m -XX:+UseConcMarkSweepGC -XX:SurvivorRatio=8 -XX:Max
TenuringThreshold=32 -Dsun.rmi.dgc.client.gcInterval=3600000 -Dsun.rmi.dgc.server.gcInterv
al=3600000 -Djava.net.preferIPv4Stack=true -XX:+CMSClassUnloadingEnabled -XX:+UseCMSInitia
tingOccupancyOnly -XX:CMSInitiatingOccupancyFraction=90 -XX:+ExplicitGCInvokesConcurrent -
Xloggc:vgc.log -XX:+PrintGCDetails -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.mana
gement.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.port=5555 -Djava.net.pr
eferIPv4Stack=true -Djava.endorsed.dirs=/home/yoshi/local/jboss-4.2.3.GA/lib/endorsed
java_command: org.jboss.Main -b 0.0.0.0
Launcher Type: SUN_STANDARD

Environment Variables:
JAVA_HOME=/home/yoshi/local/64/jdk1.6.0_14
PATH=/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/home/yoshi/local/grail
s-1.0.4/bin:/home/yoshi/bin
LD_LIBRARY_PATH=/home/yoshi/local/64/jdk1.6.0_14/jre/lib/amd64/server:/home/yoshi/local/64
/jdk1.6.0_14/jre/lib/amd64:/home/yoshi/local/64/jdk1.6.0_14/jre/../lib/amd64
SHELL=/bin/bash
:
---------------  S Y S T E M  ---------------

OS:Red Hat Enterprise Linux AS release 4 (Nahant Update 6)

uname:Linux 2.6.9-67.ELsmp #1 SMP Wed Nov 7 13:56:44 EST 2007 x86_64
libc:glibc 2.3.4 NPTL 2.3.4
rlimit: STACK 10240k, CORE infinity, NPROC 34816, NOFILE 10240, AS infinity
load average:0.67 6.02 24.26

CPU:total 4 (4 cores per cpu, 1 threads per core) family 6 model 15 stepping 11, cmov, cx8
, fxsr, mmx, sse, sse2, sse3, ssse3

Memory: 4k page, physical 3916456k(2247888k free), swap 8385920k(7127664k free)

vm_info: Java HotSpot(TM) 64-Bit Server VM (14.0-b16) for linux-amd64 JRE (1.6.0_14-b08),
built on May 21 2009 01:11:11 by "java_re" with gcc 3.2.2 (SuSE Linux)

time: Thu Jul 23 20:03:48 2009
elapsed time: 77 seconds


:
si_addr=0x0000002a962e9000

si_addr is beginning of a shared library (read, executable), thus write to
the addr would result in a trap.

2a962e7000-2a962e8000 r--p 2a962e7000 00:00 0 
2a962e8000-2a962e9000 rw-p 2a962e8000 00:00 0 
2a962e9000-2a962f0000 r-xp 00000000 03:06 7050445                        /home/yoshi/local/64/jdk1.6.0_14/jre/lib/amd64/native_threads/libhpi.so
2a962f0000-2a963f1000 ---p 00007000 03:06 7050445                        /home/yoshi/local/64/jdk1.6.0_14/jre/lib/amd64/native_threads/libhpi.so

So far, this pattern is common in four crashes.

The crash was at a compiled native method.  In this case

In two cases, the pc was in 
J  java.lang.Object.notifyAll()V  ; compiled notifyAll

In hs_err_pid3561.log, the pc was in
j  java.lang.System.currentTimeMillis()J+0  ; interpreter

In hs_err_pid13981.log, the pc was in 
j  java.lang.Object.notifyAll()V+0 ; interpreter

hs_err_pid13981.log: from internal work machine
hs_err_pid1936.log  hs_err_pid3561.log  hs_err_pid7137.log: from customer