Running BEA WebLogic with a version of the Java PetStore, we see repeated crashes with this stack trace:

=>[1] _lwp_kill(0x0, 0x19, 0x0, 0xff33c000, 0xff386000, 0xff340430), at 0xff31ee1c
  [2] raise(0x6, 0x0, 0x0, 0xffffffff, 0xff3403bc, 0x0), at 0xff2cb900
  [3] abort(0xff33c000, 0x90c7dc70, 0x0, 0x4, 0x0, 0x90c7dc91), at 0xff2b58ec
  [4] os::abort(0x1, 0xff1c15a8, 0x90c7e4f8, 0xff16816d, 0xff16810e, 0xff00), at 0xff0802b8
  [5] report_error(0x90c7e51a, 0xea4, 0xff1d9788, 0xde, 0xff10a2ac, 0xff1562c6), at 0xfef8c26c
  [6] report_fatal(0xff156283, 0x14f, 0xff1562c7, 0x0, 0x0, 0x0), at 0xfef8b924
  [7] SharedRuntime::compute_exception_return_address(0x1, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfeeb4f04
  [8] 0xfac36d18(0xfac8da88, 0x90c7f538, 0x90c7f2d0, 0x0, 0x20, 0x0), at 0xfac36d17
  [9] CompiledCodeSafepointHandler::handle_illegal_instruction_exception(0xd29550, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfee21430
  [10] 0xfac32888(0x0, 0x0, 0x0, 0x14, 0x35, 0xa2e9d5fe), at 0xfac32887
  [11] 0xfaf2b4ec(0x9fa06750, 0xf78cb7a8, 0x0, 0x4, 0xffffffcb, 0xa2e9d63c), at 0xfaf2b4eb
  [12] 0xfaf2d44c(0x9fa06598, 0x9fa06598, 0x9fa06750, 0x0, 0x0, 0x1), at 0xfaf2d44b
  [13] 0xfb08a0e0(0xa2e9d550, 0xc98de338, 0xf69398d8, 0x0, 0xd, 0xfffffffe), at 0xfb08a0df
  [14] 0xfb1c8b38(0xf68865a0, 0x9fa06598, 0xa2e9d028, 0x9fa06750, 0xc98c3878, 0xffffffff), at 0xfb1c8b37
  [15] 0xfb01d06c(0x92cf32d8, 0x10, 0x17, 0x0, 0x2e, 0x9fa06916), at 0xfb01d06b
  [16] 0xfb132228(0xc98c3be0, 0x9fa06598, 0x9fa06750, 0x0, 0x35, 0xa2e9ce9e), at 0xfb132227
  [17] 0xfb1124c4(0xc98c3be0, 0x9fa06598, 0x9fa06750, 0x4, 0x48, 0xa2e9cedc), at 0xfb1124c3
  [18] 0xfaf2d644(0x9fa06598, 0x9fa06598, 0xf6817b78, 0xa2e9cf78, 0x0, 0x1), at 0xfaf2d643
  [19] 0xfb077c38(0xa2e9cdf0, 0xc98de338, 0xf69398d8, 0x0, 0xf6f47940, 0x0), at 0xfb077c37
  [20] 0xfb04cc10(0xc98de338, 0xf69a3250, 0x0, 0x52, 0x11, 0xca0a92c6), at 0xfb04cc0f
  [21] 0xfb1212f4(0xf684e250, 0xf69a5e50, 0xfa3ba000, 0xf684db58, 0x5ffe, 0x90c7fa28), at 0xfb1212f3
  [22] 0xfac46c78(0x90c7fb94, 0x0, 0xf841a908, 0xfac15e30, 0x8, 0x90c7faa8), at 0xfac46c77
  [23] 0xfac0010c(0x90c7fc24, 0x90c7fe98, 0xa, 0xf714e3e0, 0x4, 0x90c7fb38), at 0xfac0010b
  [24] JavaCalls::call_helper(0x90c7fe90, 0x90c7fcf0, 0x90c7fdb0, 0xe8e258, 0xe8e258, 0x90c7fd04), at 0xfed67fd8
  [25] JavaCalls::call_virtual(0xff184000, 0xd058d8, 0x90c7fda4, 0x90c7fda0, 0x90c7fdb0, 0xe8e258), at 0xfee65cb8
  [26] JavaCalls::call_virtual(0x90c7fe90, 0x90c7fe8c, 0x90c7fe80, 0x90c7fe78, 0x90c7fe70, 0xe8e258), at 0xfee78ccc
  [27] thread_entry(0xe8e258, 0xe8e258, 0xb8a7a0, 0xd058d8, 0x2fff88, 0xfee83f60), at 0xfee8afc0
  [28] JavaThread::run(0xe8e258, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfee83f88
  [29] _start(0xe8e258, 0xfe8d2e00, 0x0, 0x0, 0x0, 0x0), at 0xfee803d4

This occurs on 1.4.1 FCS and 1.4.1_01 (build 01). So far, we have not observed it in mantis build 3. A fix is needed for 1.4.1_02.

This also looks exactly like bug 467904, which was closed as not reproducible. On our lab setup, this is regularly reproducible; contact me for scheduling and details.