Customer got a crash with 1.6.0_07-rev-b12.

#
# An unexpected error has been detected by Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xfeae0384, pid=25417, tid=13
#
# Java VM: Java HotSpot(TM) Server VM (10.0-b25 mixed mode solaris-sparc)
# Problematic frame:
# V  [libjvm.so+0x2e0384]
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread (0x0003e800):  GCTaskThread [stack: 0x00000000,0x00000000] [id=13]

siginfo:si_signo=SIGSEGV: si_errno=0, si_code=2 (SEGV_ACCERR), si_addr=0xf6f3f7f4

Registers:
 O0=0xf6f3f7f4 O1=0xa842abcb O2=0x00000000 O3=0x00000000
 O4=0x00000000 O5=0x00000000 O6=0xfb77f828 O7=0xfeae0aa4
 G1=0xfebcdc80 G2=0x0016e9a8 G3=0xff11cde0 G4=0xfeae2334
 G5=0xff0dbd14 G6=0x00000000 G7=0xfe2e2800 Y=0x00000000
 PC=0xfeae0384 nPC=0xfeae0388


Top of Stack: (sp=0xfb77f828)
0xfb77f828:   00000000 00000000 00000000 00000000
0xfb77f838:   00000000 00000000 00000000 00000000
0xfb77f848:   00035a58 a842abcb 00000102 00000002
0xfb77f858:   f6f3f7f4 00035a58 fb77f888 feae0930
0xfb77f868:   ff0c4000 00000001 00000006 00000046
0xfb77f878:   e8000000 039d2000 f4580000 00008000
0xfb77f888:   00000000 80d20308 00059270 00059000
0xfb77f898:   80d202f8 000003d8 ff0faf68 007f18f6 

Instructions: (pc=0xfeae0384)
0xfeae0374:   c0 26 e0 60 c0 26 e0 64 81 c7 e0 08 81 e8 20 00
0xfeae0384:   da 02 20 00 88 10 00 08 c6 02 60 00 80 a2 40 0d 
;; 00000000feae0374 c0 26 e0 60 c0 26 e0 64 81 c7 e0 08 81 e8 20 00
;; ---------------
;; 00000000feae0384 da 02 20 00             ld  [ %o0 ], %o5
;; 00000000feae0388 88 10 00 08             mov  %o0, %g4
;; 00000000feae038c c6 02 60 00             ld  [ %o1 ], %g3
;; 00000000feae0390 80 a2 40 0d             cmp  %o1, %o5
;; 
Stack: [0x00000000,0x00000000],  sp=0xfb77f828,  free space=-74242k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x2e0384];;  TreeList*TreeList::removeChunkReplaceIfNeeded(TreeChunk*)+0x0
V  [libjvm.so+0x2e0938];;  TreeChunk*BinaryTreeDictionary::getChunkFromTree(unsigned,FreeBlockDictionary::Dither,bool)+0x1c0
V  [libjvm.so+0x3cdc88];;  void CompactibleFreeListSpace::par_get_chunk_of_blocks(unsigned,unsigned,FreeList*)+0x1c8
V  [libjvm.so+0x3cd9a0];;  HeapWord*CFLS_LAB::alloc(unsigned)+0xe0
V  [libjvm.so+0x3df3dc];;  oopDesc*ConcurrentMarkSweepGeneration::par_promote(int,oopDesc*,markOopDesc*,unsigned)+0x8c
V  [libjvm.so+0x67a4c8];;  oopDesc*ParNewGeneration::copy_to_survivor_space_avoiding_promotion_undo(ParScanThreadState*,oopDesc*,unsigned,markOopDesc*)+0x200
V  [libjvm.so+0x67b44c];;  void ParScanClosure::do_oop_work(oopDesc**,bool,bool)+0xcc
V  [libjvm.so+0x662df8];;  int objArrayKlass::oop_oop_iterate_nv_m(oopDesc*,ParScanWithBarrierClosure*,MemRegion)+0xe8
V  [libjvm.so+0x678d4c];;  void ParEvacuateFollowersClosure::do_void()+0x294
V  [libjvm.so+0x6792e4];;  void ParNewGenTask::work(int)+0x180
V  [libjvm.so+0x76a534];;  void GangWorker::loop()+0x8c
V  [libjvm.so+0x6699dc];;  java_start+0x170

[--snip--]
vm_info: Java HotSpot(TM) Server VM (10.0-b25) for solaris-sparc JRE (1.6.0_07-rev-b12), built on Aug 12 2008 11:29:56 by "" with Workshop 5.8
[--snip--]

The full Java Error Log (hs_err_pid25417.log) is attached to this bug report.