Threads can escape the 'safepoint' mechanism when calling static natives in the interpreter.
I ran mtrt overnight in a core debug windows build; it failed sometime in the night.

----------------------------------------------------------------------
C:\users\cliffc\spec>java_g -core SpecApplication -a -m1 -M1 _227_mtrt
Will run each benchmark at least 1 times
Will run each benchmark at most 1 times
Caching Off Speed = 100 Auto run mode

======= _227_mtrt Starting =======
Run 0 start. Total memory=2031616 free memory=1864744
+100 to 199 by 200
+0 to 99 by 200
invokestatic 184 invokestatic [0x00A6B5A0, 0x00A6B6D0[ 304 bytes safepoint safe
#
# HotSpot Virtual Machine Error, Internal Error
# Please report this error at
# http://java.sun.com/cgi-bin/bugreport.cgi
#
# Java VM: Java HotSpot(TM) Core VM (1.4.1-internal-debug interpreted mode)
#
# Fatal: Wrong safepoint info in interpreter
#
# Error ID: v:\ctw\src\share\vm\runtime\safepoint.cpp, 313
#
# Problematic Thread: prio=5 tid=0x009DEAC8 nid=0x548 runnable
#
# SafepointSynchronize::begin: Fatal error:
# SafepointSynchronize::begin: Timed out while attempting to reach a safepoint.
# SafepointSynchronize::begin: Threads which did not reach the safepoint:
# Thread: 0x009DEAC8 [0x548] State: _call_back pc: 0x00A6B5C9
nid=0x548 runnable
# SafepointSynchronize::begin: (End of list)

----------------------------------------------------------------------
A ps() reports:
"Executing ps"
 for thread: "Thread-2" prio=5 tid=0x009DEAC8 nid=0x548 runnable [1850f000..1850fd6c]
Thread state: _thread_in_native_trans
Thread: 0x009DEAC8 [0x548] State: _call_back pc: 0x00A6B5C9

 1 - java.lang.StrictMath.sqrt(Native Method)
 2 - java.lang.Math.sqrt(Math.java:277)
 3 - spec.benchmarks._205_raytrace.Vector.Length(Vector.java:159)
 4 - spec.benchmarks._205_raytrace.Scene.GetLightColor(Scene.java:532)
 5 - spec.benchmarks._205_raytrace.Scene.Shade(Scene.java:449)
 6 - spec.benchmarks._205_raytrace.Scene.RenderScene(Scene.java:650)
 7 - spec.benchmarks._205_raytrace.Runner.run(RayTracer.java:133)

----------------------------------------------------------------------
Here's the interpreter code snippets between c2-baseline and Merlin.
Notice the save/restores of ESI.

invokestatic code snippet, CORE windows debug build

   Current C2-baseline Merlin
                
0xa6b5a0: subl 4,%esp 0xa5b1bc: subl 4,%esp
0xa6b5a3: fstps (%esp,1) 0xa5b1bf: fstps (%esp,1)
0xa6b5a6: jmp 0xa6b5b8 0xa5b1c2: jmp 0xa5b1d4
0xa6b5ab: subl 8,%esp 0xa5b1c7: subl 8,%esp
0xa6b5ae: fstpl (%esp,1) 0xa5b1ca: fstpl (%esp,1)
0xa6b5b1: jmp 0xa6b5b8 0xa5b1cd: jmp 0xa5b1d4
0xa6b5b6: pushl %edx 0xa5b1d2: pushl %edx
0xa6b5b7: pushl %eax 0xa5b1d3: pushl %eax
0xa6b5b8: movl %esi,-20(%ebp) <--------------
0xa6b5bb: movzwl 1(%esi),%edx 0xa5b1d4: movzwl 1(%esi),%edx
0xa6b5bf: movl -12(%ebp),%ecx 0xa5b1d8: movl -12(%ebp),%ecx
0xa6b5c2: shll 0x2,%edx 0xa5b1db: shll 0x2,%edx
0xa6b5c5: movl 16(%ecx,%edx,4),%ebx 0xa5b1de: movl 16(%ecx,%edx,4),%ebx
0xa6b5c9: shrl 0x10,%ebx 0xa5b1e2: shrl 0x10,%ebx
0xa6b5cc: andl 0xff,%ebx 0xa5b1e5: andl 0xff,%ebx
0xa6b5d2: jne 0xa6b69a 0xa5b1eb: jne 0xa5b2b3
0xa6b5d8: movl 0xb8,%ebx 0xa5b1f1: movl 0xb8,%ebx
0xa6b5dd: call 0xa6b5e7 0xa5b1f6: call 0xa5b200
0xa6b5e2: jmp 0xa6b690 0xa5b1fb: jmp 0xa5b2a9
0xa6b5e7: pushl %ebx 0xa5b200: pushl %ebx
0xa6b5e8: leal 8(%esp,1),%eax 0xa5b201: leal 8(%esp,1),%eax
0xa6b5ec: movl %esi,-20(%ebp) 0xa5b205: movl %esi,-20(%ebp) <-------
0xa6b5ef: movl %fs:24,%edi 0xa5b208: movl %fs:24,%edi
0xa6b5f6: movl 3608(%edi),%edi 0xa5b20f: movl 3608(%edi),%edi
0xa6b5fc: pushl %edi 0xa5b215: pushl %edi
0xa6b5fd: movl %ebp,316(%edi) 0xa5b216: movl %ebp,308(%edi)
0xa6b603: movl %eax,148(%edi) 0xa5b21c: movl %eax,148(%edi)
0xa6b609: call 0x807a464 0xa5b222: call 0x8063473
0xa6b60e: pushl %eax 0xa5b227: pushl %eax
0xa6b60f: movl %fs:24,%eax 0xa5b228: movl %fs:24,%eax
0xa6b616: movl 3608(%eax),%eax 0xa5b22f: movl 3608(%eax),%eax
0xa6b61c: cmpl %eax,%edi 0xa5b235: cmpl %eax,%edi
0xa6b61e: je 0xa6b635 0xa5b237: je 0xa5b24e
0xa6b624: pushl 0x81944b0 0xa5b23d: pushl 0x815ef5c
0xa6b629: call 0xa6b62e 0xa5b242: call 0xa5b247
0xa6b62e: pusha 0xa5b247: pusha
0xa6b62f: call 0x80114f9 0xa5b248: call 0x810d16b
0xa6b634: hlt 0xa5b24d: hlt
0xa6b635: popl %eax 0xa5b24e: popl %eax
0xa6b636: movl 0x0,148(%edi) 0xa5b24f: movl 0x0,148(%edi)
0xa6b640: movl 0x0,316(%edi) 0xa5b259: movl 0x0,308(%edi)
0xa6b64a: addl 8,%esp 0xa5b263: addl 8,%esp
0xa6b64d: movl 100(%edi),%edi 0xa5b266: movl 96(%edi),%edi
0xa6b650: testl 0x1,%edi 0xa5b269: testl 0x1,%edi
0xa6b656: je 0xa6b66f 0xa5b26f: je 0xa5b288
0xa6b65c: testl 0x4,%edi 0xa5b275: testl 0x4,%edi
0xa6b662: jne 0xa6b66f 0xa5b27b: jne 0xa5b288
0xa6b668: call 0x8011be0 0xa5b281: call 0x800f7e0
0xa6b66d: jmp *%eax 0xa5b286: jmp *%eax
0xa6b66f: movl %fs:24,%edi 0xa5b288: movl %fs:24,%edi
0xa6b676: movl 3608(%edi),%edi 0xa5b28f: movl 3608(%edi),%edi
0xa6b67c: cmpl 0x0,4(%edi) 0xa5b295: cmpl 0x0,4(%edi)
0xa6b683: jne Stub::forward exception 0xa5b29c: jne Stub::forward exception
0xa6b689: movl -20(%ebp),%esi 0xa5b2a2: movl -20(%ebp),%esi <------------
0xa6b68c: movl -16(%ebp),%edi 0xa5b2a5: movl -16(%ebp),%edi
0xa6b68f: ret 0xa5b2a8: ret
0xa6b690: movzwl 1(%esi),%edx 0xa5b2a9: movzwl 1(%esi),%edx
0xa6b694: movl -12(%ebp),%ecx 0xa5b2ad: movl -12(%ebp),%ecx
0xa6b697: shll 0x2,%edx 0xa5b2b0: shll 0x2,%edx
0xa6b69a: movl 20(%ecx,%edx,4),%ebx 0xa5b2b3: movl 20(%ecx,%edx,4),%ebx
0xa6b69e: movl 28(%ecx,%edx,4),%edx 0xa5b2b7: movl 28(%ecx,%edx,4),%edx
                                       0xa5b2bb: movl %esi,-20(%ebp) <----------------
0xa6b6a2: shrl 0x1c,%edx 0xa5b2be: shrl 0x1c,%edx
0xa6b6a5: movl 136887284(,%edx,4),%edx 0xa5b2c1: movl 136539212(,%edx,4),%edx
0xa6b6ac: pushl %edx 0xa5b2c8: pushl %edx
0xa6b6ad: jmp *52(%ebx) 0xa5b2c9: jmp *44(%ebx)
0xa6b6b0: pushl 0x81cec04 0xa5b2cc: pushl 0x8189180
0xa6b6b5: call 0xa6b6ba 0xa5b2d1: call 0xa5b2d6
0xa6b6ba: pusha 0xa5b2d6: pusha
0xa6b6bb: call 0x80114f9 0xa5b2d7: call 0x810d16b
0xa6b6c0: hlt 0xa5b2dc: hlt
0xa6b6c1: nop 0xa5b2dd: nop
0xa6b6c2: nop 0xa5b2de: nop
0xa6b6c3: nop 0xa5b2df: nop
0xa6b6c4: int3
0xa6b6c5: int3
0xa6b6c6: int3
0xa6b6c7: int3
0xa6b6c8: int3
0xa6b6c9: int3
0xa6b6ca: int3
0xa6b6cb: int3
0xa6b6cc: int3
0xa6b6cd: int3
0xa6b6ce: int3
0xa6b6cf: int3