The methods append(char[] str, int offset, int len) in StringBuilder and StringBuffer classes throw OutOfMemoryError when the len parameter is negative and its value is near to the Integer.MIN_VALUE.  However, the spec says that it throws IndexOutOfBoundsException if offset < 0 or len < 0 or offset+len > str.length. 

Example:

=================
public class Main {

    public static void main(String[] args) {
        StringBuffer  sb = new StringBuffer("this is a test string");
        char[] str = {'a', 'b', 'c', 'd'};
        sb.append(str, 0, Integer.MIN_VALUE + 10);
    }

}
===================

# The problem is reproducible in JDK 7 b94:

<ag153348@spb-piker> /set/java/re/jdk/7/promoted/ea/b94/binaries/linux-i586/bin/java -cp /net/spb-piker/export/users/ag153348/trash/JavaApplication5/build/classes Main
Exception in thread "main" java.lang.OutOfMemoryError
	at java.lang.AbstractStringBuilder.expandCapacity(AbstractStringBuilder.java:125)
	at java.lang.AbstractStringBuilder.ensureCapacityInternal(AbstractStringBuilder.java:112)
	at java.lang.AbstractStringBuilder.append(AbstractStringBuilder.java:532)
	at java.lang.StringBuffer.append(StringBuffer.java:322)
	at Main.main(Main.java:17)

# But not in JDK 7 b93:

<ag153348@spb-piker> /set/java/re/jdk/7/promoted/ea/b93/binaries/linux-i586/bin/java -cp /net/spb-piker/export/users/ag153348/trash/JavaApplication5/build/classes Main
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException
	at java.lang.System.arraycopy(Native Method)
	at java.lang.AbstractStringBuilder.append(AbstractStringBuilder.java:535)
	at java.lang.StringBuffer.append(StringBuffer.java:322)
	at Main.main(Main.java:17)


The following JCK 7 tests fail due to this issue:

    api/java_lang/StringBuffer/index.html#append[StringBuffer0023]
    api/java_lang/StringBuilder/index.html#append[StringBuilder0023]     api/java_lang/StringBuilder/index.html#lengthAndCapacity[StringBuilder0006]


Example Steps how to run the JCK tests:

<ag153348@spb-piker> /set/java/re/jdk/7/promoted/ea/b94/binaries/linux-i586/bin/java -jar /set/java/re/jck/7/qac/latest/binaries/JCK-runtime-7/lib/jtjck.jar -mode:multi api/java_lang/StringBuilder api/java_lang/StringBuffer
Rebuilding result cache!!
Rebuilt result cache!!
May 25, 2010 6:34:51 PM Harness starting test run with configuration "jck_runtime_linux"...
May 25, 2010 6:34:52 PM Finished executing all tests, wait for cleanup...
May 25, 2010 6:34:52 PM Harness done with cleanup from test run.
Test results: passed: 31; failed: 3
Results written to /net/spb-piker/export/users/ag153348/tmp/JCK-runtime-7_b36-work.
Error: Some tests did not pass
<ag153348@spb-piker> /set/java/re/jdk/7/promoted/ea/b93/binaries/linux-i586/bin/java -jar /set/java/re/jck/7/qac/latest/binaries/JCK-runtime-7/lib/jtjck.jar -mode:multi api/java_lang/StringBuilder api/java_lang/StringBuffer
Rebuilding result cache!!
Rebuilt result cache!!
May 25, 2010 6:38:28 PM Harness starting test run with configuration "jck_runtime_linux"...
May 25, 2010 6:38:29 PM Finished executing all tests, wait for cleanup...
May 25, 2010 6:38:29 PM Harness done with cleanup from test run.
Test results: passed: 34
Results written to /net/spb-piker/export/users/ag153348/tmp/JCK-runtime-7_b36-work.

Note: I've tested this on Linux (spb-piker.russia) and Solaris 10 Sparc (nexus.sfbay).
The similar exeception now throws the ArrayList.ensureCapacity method.

Example:

==========
public class Main {

    public static void main(String[] args) {
        ArrayList a = new ArrayList();        
        a.ensureCapacity(Integer.MIN_VALUE);
    }

}
===========

# It fails in JDK 7 b94:

<ag153348@spb-piker> /set/java/re/jdk/7/promoted/ea/b94/binaries/linux-i586/bin/java -cp /net/spb-piker/export/users/ag153348/trash/JavaApplication5/build/classes Main
Exception in thread "main" java.lang.OutOfMemoryError
	at java.util.ArrayList.hugeCapacity(ArrayList.java:213)
	at java.util.ArrayList.grow(ArrayList.java:206)
	at java.util.ArrayList.ensureCapacity(ArrayList.java:182)
	at Main.main(Main.java:20)

# But passes in JDK 7 b93:
<ag153348@spb-piker> /set/java/re/jdk/7/promoted/ea/b93/binaries/linux-i586/bin/java -cp /net/spb-piker/export/users/ag153348/trash/JavaApplication5/build/classes Main

The issue with ArrayList.ensureCapacity effects the following JCK test:
   api/java_util/ArrayList/TestDesc.html#ALEnsureCapacityTest

<ag153348@spb-piker> /set/java/re/jdk/7/promoted/ea/b94/binaries/linux-i586/bin/java -jar /set/java/re/jck/7/qac/latest/binaries/JCK-runtime-7/lib/jtjck.jar -mode:multi api/java_util/ArrayList/TestDesc.html#ALEnsureCapacityTest
Rebuilding result cache!!
Rebuilt result cache!!
May 25, 2010 7:12:40 PM Harness starting test run with configuration "jck_runtime_linux"...
May 25, 2010 7:12:40 PM Finished executing all tests, wait for cleanup...
May 25, 2010 7:12:40 PM Harness done with cleanup from test run.
Test results: failed: 1
Results written to /net/spb-piker/export/users/ag153348/tmp/JCK-runtime-7_b36-work.
Error: Some tests did not pass