Java_sun_awt_font_NativeFontWrapper_setNativeFontPath has the following code:

const char *theChars;

theChars = (*env)->GetStringUTFChars (env, theString, 0);
if (theChars) {
   (*env)->ReleaseStringCritical (env, theString, (const jchar*)theChars);
}

That ReleaseStringCritical ought to be ReleaseStringUTFChars.

This problem was exposed when we added careful checking in the Hotspot VM to
ensure that critical regions are properly nested.

A high priority is given to this bug because the GC locking mechanism
assumes properly nested critical regions so it can use a simple counter to
record when they are entered and exited. GC cannot occur if the count
is greater than zero. After this bad code is executed, we're off by
one and GC cannot be locked again (so jni critical regions won't work any more).