customers app cores on 1.3.1_03 with both the -server and -client flags and with both the libthread and alt libthread on Solaris on Solaris 8 being run through BEA's weblogic server.
Are able to reproduce the crash in less than an hour when they load
the application with requests for JPEG images.
there is no standalone testcase, but they have reproduced this in there development env. and aer working on a test case.

the dbx output and pstack from running with java_g is in
/net/cores.ebay/cores/62910540/JAVA_G/core.1.08-APR-2002-client.log
and
/net/cores.ebay/cores/62910540/JAVA_G/core.3.08-APR-2002-server.log
The crash with the -client has the error
#
# HotSpot Virtual Machine Error, Internal Error
# Please report this error at
# http://java.sun.com/cgi-bin/bugreport.cgi
#
# Error ID: 5448524541442C4F43414C33544F524147450E4350500022 01
#
# Problematic Thread: prio=5 tid=0x591698 nid=0xf runnable
#

Abort - core dumped
 ff31bee0 _lwp_kill (6, 0, 0, ffffffff, ff33e3cc, 0) + 8
 ff2b5aac abort (ff33a004, ca77cdd8, 0, 4, 0, ca77cdf9) + 100
 ff0e836c __1cCosFabort6Fl_v_ (1, ff196000, 1, ff196000, 591698, ca77cdf4) + b8
 ff053258 __1cMreport_error6Flpkci11E_v_ (d4, ca77d684, 22, ff147838, ff1d1880, ff196000) + 3e8
 ff052b28 __1cMreport_fatal6Fpkci1E_v_ (22, ff196000, ff1683a0, 33fcaca, 2ccd8, 0) + 60
 feee7c94 __1cSThreadLocalStorageUget_thread_via_cache6F_pnGThread__ (ff1ace58, 1c4, ca77e, ff196000, 591698, ca77e01c) + e0
 fef4dba0 __1cFMutexElock6M_v_ (29400, 6, ff3a19d0, ff196000, 0, 5) + 14
 ff0003a4 jni_ReleasePrimitiveArrayCritical (59221c, 2f68b58, ff1a6284, 29400, ff196000, 592190) + 64
 ca2d5714 ReleaseArrays (ca77e368, 1, ca77e160, ca2d60b4, 5a9c50, ca87dddc) + 6c
 ca2d60c8 processJPEGStream (ca2e493c, ca77e4fc, ca77e504, 59221c, ca77e4f8, ca77e4f4) + 138
 ca2d5e4c Java_sun_awt_image_codec_JPEGImageEncoderImpl_writeJPEGStream (59221c, ca77e504, ca77e500, ca77e4fc, ca77e4f8, ca77
e4f4) + 28
 000ba6d0 ???????? (cf1de6b8, 0, 1, bf7bc, ca77e4fc, 0)
 000b7464 ???????? (cf1de6b8, 58e618, ff196000, c2a94, 0, 0)
 000b7464 ???????? (cf1de6b8, b969c, 0, c2a94, cf5c0000, 0)
 000b770c ???????? (cdc6e608, b94b0, ff196000, c2bcc, 592190, 0)
 000b770c ???????? (592190, ff196000, ffffffff, c2bcc, 400, 221628)
 ff1cb454 __1cMStubRoutinesG_code1_ (ca77e848, ca77e9b0, a, fa43e510, b94b0, ca77ea28) + 40c
 fef81a54 __1cJJavaCallsLcall_helper6FpnJJavaValue_pnMmethodHandle_pnRJavaCallArguments_pnGThread__v_ (ca77e9a8, ff196000, ca
77ea18, 592190, b94b0, ca77e9b0) + 308
 fef816e4 __1cJJavaCallsEcall6FpnJJavaValue_nMmethodHandle_pnRJavaCallArguments_pnGThread__v_ (ca77e9a8, ca77e9a4, ca77ea18,
592190, ca77ea90, 592190) + 2c
 ff021ef4 __1cKReflectionGinvoke6FnTinstanceKlassHandle_nMmethodHandle_nGHandle_lnOobjArrayHandle_nJBasicType_4lpnGThread__pn
HoopDesc__ (c, ca77eb68, ff196000, 592190, ca77ea18, c) + e48
 ff02100c __1cKReflectionNinvoke_method6FpnHoopDesc_nGHandle_nOobjArrayHandle_pnGThread__2_ (fa368a88, 0, ca77ebf8, 592190, c
a77ebfc, 0) + 2b0
 ff020bf4 JVM_InvokeMethod (ff1aa2a4, cfd114f8, cdc6e2b8, 592190, 59221c, ca77ed4c) + 174
 fec6d258 Java_java_lang_reflect_Method_invoke (59221c, ca77ed54, ca77ed50, ca77ed4c, 592190, 0) + 10
 000ba300 ???????? (cfd114f8, ca77edc8, ca77edcc, bf7bc, ca77ed78, 0)
 000b74a8 ???????? (cfd283e8, cfd4ae80, cdc6e2b8, c29f0, 2, ff196000)
 fbb317e0 ???????? (cfd005a0, fa362738, fa4c07b0, cdc6e2b8, ff196000, 0)
 000b74a8 ???????? (cfd005a0, 10, 4, c2a94, f9402f08, fa36a390)
 000b74a8 ???????? (cdc6a210, 1, 1, c2940, cf5c0000, 0)
 000b74a8 ???????? (cdc69f50, fa33cd88, 0, c2940, cf5c0000, 0)
 000b74a8 ???????? (cdc69f50, ca77f140, ca77f144, c2940, 1, 0)
 000b7464 ???????? (cdc69f50, b94b0, 54, c2940, 592190, 0)
 000b74a8 ???????? (cfd111a8, ca77f260, ca77f264, c2940, cf5c0000, 0)
 000b74a8 ???????? (0, fa331bb0, 0, c29f0, cf5c0000, 0)
 000b74a8 ???????? (cdc69a20, 100, 2bc, c2b38, cf5c0000, 0)
 000b74a8 ???????? (cdc67ea0, ca77f420, ca77f424, c2b38, cf5c0000, 0)
 000b7464 ???????? (d5eddde0, d06b2310, fa292490, c29f0, fa2924d8, 5)
 fbb2f538 ???????? (d3bd4738, d3bd4750, d06b2310, cfbcf688, cf5c0000, cdc679e0)
 000b7464 ???????? (cfc8e820, b94b0, ca77f5e0, c2940, 8c, 0)
 000b7464 ???????? (cfc8e820, ca77f678, ca77f67c, c2940, d, 0)
 000b7464 ???????? (cfc8e820, fa28a2e0, 2bc, c2940, cf5c0000, 0)
 000b7464 ???????? (cfc8e820, ffffffff, ffffffff, c2940, f9616200, 3)
 000b7464 ???????? (cfc8e820, ca77f860, ca77f864, c2940, ca77f78c, 0)
 000b7464 ???????? (cfc8e820, b94b0, ff196000, c2940, 0, 0)
 000b770c ???????? (cfbfb908, ca77f9b0, ca77f9b4, c2bcc, d06b0268, 0)
 000b7464 ???????? (cfbfb908, f94f5070, cf81ba98, c29f0, f94f5070, 0)
 000b7464 ???????? (cfbcf688, ca77fad0, ca77fad4, c29f0, 0, 0)
 000b7464 ???????? (d05ff840, cf8d3408, 0, c29f0, 0, 0)
 fba51014 ???????? (cf8d3408, d05ff840, ca77fb58, bf4b4, ce336858, 0)
 000b7464 ???????? (0, 1, ff1a2918, c29f0, 1e, e)
 ff1cb454 __1cMStubRoutinesG_code1_ (ca77fc68, ca77fea0, a, f97dc880, b94b0, ca77fdec) + 40c
 fef81a54 __1cJJavaCallsLcall_helper6FpnJJavaValue_pnMmethodHandle_pnRJavaCallArguments_pnGThread__v_ (ca77fe98, ff196000, ca
77fde4, 592190, b94b0, ca77fea0) + 308
 fef906ec __1cJJavaCallsMcall_virtual6FpnJJavaValue_nLKlassHandle_nMsymbolHandle_4pnRJavaCallArguments_pnGThread__v_ (f97dca5
8, ca77fdd0, ca77fdd4, ff196000, ca77fe98, ca77fde4) + 150
 fef9057c __1cJJavaCallsMcall_virtual6FpnJJavaValue_nGHandle_nLKlassHandle_nMsymbolHandle_5pnGThread__v_ (ca77fe98, ca77fe94,
 ca77fe90, ca77fe84, ca77fe7c, 592190) + 60
 fef90504 __1cMthread_entry6FpnKJavaThread_pnGThread__v_ (f9417000, 592190, ff196000, ca77ffa0, 1e, e) + 120
 fef90310 __1cKJavaThreadDrun6M_v_ (ca700000, ff19feb4, ff196000, 80000, 592190, 80000) + 3d8
 fef80134 _start (ff196000, fece1c00, 0, 0, 0, 0) + 20
 ff374934 _lwp_start (0, 0, 0, 0, 0, 0)


the -server crash is

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : 11 occurred at PC=0xc7e55708
Function name=Java_sun_awt_image_codec_JPEGImageDecoderImpl_readJPEGStream
Library=/opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/libjpeg.so

Current Java thread:
at sun.awt.image.codec.JPEGImageEncoderImpl.writeJPEGStream(Native
Method)
at
sun.awt.image.codec.JPEGImageEncoderImpl.encode(JPEGImageEncoderImpl.java:47
0)
at
sun.awt.image.codec.JPEGImageEncoderImpl.encode(JPEGImageEncoderImpl.java:22
6)
at
com.sun.media.jai.codecimpl.JPEGImageEncoder.encode(JPEGImageEncoder.java:20
3)
at com.sun.media.jai.opimage.EncodeRIF.create(EncodeRIF.java:74)
at java.lang.reflect.Method.invoke(Native Method)
at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
at
javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1669)
at
javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperatio
nRegistry.java:481)
at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:805)
at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:853)
at javax.media.jai.RenderedOp.getRendering(RenderedOp.java:874)
at javax.media.jai.JAI.createNS(JAI.java:913)
at javax.media.jai.JAI.create(JAI.java:786)
at javax.media.jai.JAI.create(JAI.java:1471)
at com.gale.dlv.imageserv.JaiWrapper.write(JaiWrapper.java:140)
at
com.gale.dlv.imageserv.JaiImageProcessor.output(CommandProcessor.java:199)
at
com.gale.dlv.imageserv.CommandProcessor.exec(CommandProcessor.java:430)
at com.gale.dlv.imageserv.ImageServlet.go(ImageServlet.java:168)
at com.gale.dlv.imageserv.ImageServlet.fetch(ImageServlet.java:130)
at com.gale.dlv.imageserv.ImageServlet.fetch(ImageServlet.java:125)
at com.gale.dlv.imageserv.ImageServlet.doGet(ImageServlet.java:401)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at
weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java
:263)
at
weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java
:200)
at
weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletCo
ntext.java:2390)
at
weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java
:1959)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:137)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:120)

Dynamic libraries:
0x10000 /usr/java/jre/bin/../bin/sparc/native_threads/java
0xff360000 /usr/lib/lwp/libthread.so.1
0xff390000 /usr/lib/libdl.so.1
0xff280000 /usr/lib/libc.so.1
0xff270000 /usr/platform/SUNW,Ultra-80/lib/libc_psr.so.1
0xfec00000 /opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/server/libjvm.so
0xff220000 /usr/lib/libCrun.so.1
0xff200000 /usr/lib/libsocket.so.1
0xfeb00000 /usr/lib/libnsl.so.1
0xff1d0000 /usr/lib/libm.so.1
0xff250000 /usr/lib/libw.so.1
0xff1a0000 /usr/lib/libmp.so.2
0xff170000 /usr/lib/librt.so.1
0xff150000 /usr/lib/libaio.so.1
0xff120000
/opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/native_threads/libhpi.so
0xfebc0000 /opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/libverify.so
0xfeab0000 /opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/libjava.so
0xfea80000 /opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/libzip.so
0xfe950000 /usr/lib/nss_files.so.1
0xcb5e0000 /opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/libnet.so
0xcb5c0000 /opt/bea/wlserver/lib/solaris/libmuxer.so
0xcaa10000 /opt/IBMdb2/V7.1/java12/libdb2jdbc.so
0xc3400000 /opt/IBMdb2/V7.1/lib/libdb2.so.1
0xc8fb0000 /usr/lib/libresolv.so.2
0xca960000 /usr/lib/nss_dns.so.1
0xc8440000 /opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/libawt.so
0xc2980000
/opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/motif21/libmawt.so
0xc8330000 /usr/java/jre/bin/../lib/sparc/libmlib_image.so
0xc2700000 /usr/dt/lib/libXm.so.4
0xc8210000 /usr/openwin/lib/libXt.so.4
0xc8150000 /usr/openwin/lib/libXext.so.0
0xc8410000 /usr/openwin/lib/libXtst.so.1
0xc2600000 /usr/openwin/lib/libX11.so.4
0xc8130000 /usr/openwin/lib/libSM.so.6
0xc8050000 /usr/openwin/lib/libICE.so.6
0xc8020000 /usr/openwin/lib/libdga.so.1
0xc7f30000 /opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/libcmm.so
0xc1c00000 /opt/gale/lib/libmlib_jai_vis.so
0xc7e40000 /opt/DEBUG_JDK/j2sdk1_3_1_03/jre/lib/sparc/libjpeg.so

Local Time = Mon Apr 8 09:37:52 2002
Elapsed Time = 2088
#
# The exception above was detected in native code outside the VM
#
# Java VM: Java HotSpot(TM) Server VM (1.3.1_03-b03 mixed mode)
#
# An error report file has been saved as hs_err_pid4745.log.
# Please refer to the file for further information.
#

 ff31bee0 _lwp_kill (6, 0, 0, ffffffff, ff33e3cc, 0) + 8
 ff2b5aac abort (ff33a004, c86fd228, 0, 4, 0, c86fd249) + 100
 fefa93b4 __1cCosFabort6Fl_v_ (1, ff0a2000, 1, c86fd2a8, 0, c7e55708) + b8
 fefa84dc __1cCosbBhandle_unexpected_exception6FpnGThread_ipCpv_v_ (ff33e2bc, ff1111f8, ff0b4e9c, ff0490f8, ff0a2000, c86fd2c
8) + 254
 fee08dc4 JVM_handle_solaris_signal (0, 670be0, c86fdd78, ff0a2000, b, c86fe030) + 8ec
 ff374c8c __sighndlr (b, c86fe030, c86fdd78, fee08ddc, 0, 0) + c
 ff36fadc call_user_handler (febf2000, 12, ff3878e0, c86fdd78, c86fe030, b) + 254
 ff36fca8 sigacthandler (febf2000, c86fe030, c86fdd78, ff386000, c86fe030, b) + 64
 --- called from signal handler with signal -21028864 (SIG Unknown) ---
 c7e55708 ReleaseArrays (c86fe2bc, 1, c86fe110, c7e560b4, 8a6900, c80fdd8c) + 60
 c7e560c8 processJPEGStream (e6d98e40, cd8f8c48, 1, 0, f7894918, e6d9b760) + 138
 c7e55e4c Java_sun_awt_image_codec_JPEGImageEncoderImpl_writeJPEGStream (0, fb976874, 0, c86fe4b0, 193220, 2) + 28