Reported on a forum:

http://forum.java.sun.com/thread.jspa?threadID=741527&tstart=75

A quick look reveals it is a null pointer from region->in(2) in these lines of locknode.cpp:

bool AbstractLockNode::find_matching_unlock(const RegionNode* region, FastLockNode* lock,
                                            GrowableArray<AbstractLockNode*> &lock_ops) {
  IfFalseNode* fast_unlock_false = NULL;
  // the region for the merge has exactly three inputs, control, a
  // control Proj and the IfFalse.
  if (region->req() == 3) {
    fast_unlock_false = region->in(2)->is_IfFalse();
  }

Attached file is annotated crash log.