Standalone test case is attached.
Need to have the attached ef.jar in the classpath.

I had problems setting up the environment for the standalone testcase as this originally came in as an application server case.

So we have used application server 6.0SP4 to set the environment
in the ias6/ias/env directory.
# ksh
# script=kjs
# . ./iasenv.ksh

this will default to 1.2.2_10 but I have test with 1.2.2_15 with the same results.

compiling and running the test case resulted in a core dump with the following stack trace

t@1 (l@1) terminated by signal ABRT (Abort)
0xfef9bdc4: __lwp_kill+0x0008: bgeu,a __lwp_kill+0x1c
(dbx) where
current thread: t@1
=>[1] __lwp_kill(0x0, 0x1, 0x0, 0xfefba000, 0xff026000, 0xfefbe428), at 0xfef9bdc4
  [2] raise(0x6, 0x0, 0x0, 0xffffffff, 0x251d0, 0x0), at 0xfef4b758
  [3] abort(0xfefba000, 0x0, 0x0, 0x0, 0x0, 0x0), at 0xfef35a7c
  [4] panicHandler(0x0, 0xffbed8d0, 0xffbed618, 0xff337000, 0x6, 0x0), at
0xff24145c
  [5] __sighndlr(0x6, 0xffbed8d0, 0xffbed618, 0xff24009c, 0x0, 0x0), at
0xff014cc8
  [6] call_user_handler(0xff0275a8, 0x1, 0xff027840, 0xffbed618, 0xffbed8d0,
0x6), at 0xff00fb00
  [7] sigacthandler(0xff0275a8, 0xffbed8d0, 0xffbed618, 0xff026000, 0xffbed8d0,
0x6), at 0xff00fccc
  ---- called from signal handler with signal 6 (SIGABRT) ------
  [8] __lwp_kill(0x0, 0x1, 0x5, 0xfefba000, 0x0, 0xffbeda20), at 0xfef9bdc4
  [9] raise(0x6, 0x6, 0xffbeda10, 0x6, 0xff31c03c, 0x0), at 0xfef4b758
  [10] abort(0xfefba000, 0xffbedeb8, 0x2000, 0x1b3f2000, 0xb, 0xff34d800), at
0xfef35a3c
  [11] __sighndlr(0xb, 0xffbedeb8, 0xffbedc00, 0xff24009c, 0x0, 0x0), at
0xff014cc8
  [12] call_user_handler(0xff0275a8, 0x1, 0xff0278e0, 0xffbedc00, 0xffbedeb8,
0xb), at 0xff00fb00
  [13] sigacthandler(0xff0275a8, 0xffbedeb8, 0xffbedc00, 0xff026000, 0xffbedeb8,
0xb), at 0xff00fccc
  ---- called from signal handler with signal 11 (SIGSEGV) ------
  [14] genCodeForLoopValue(0x0, 0x2558f0, 0xffbeea48, 0xffbeea48, 0x25b2e8,
0x20000000), at 0xff2e6658
  [15] generateCodeForSplitPred(0xffbeea48, 0x2558f0, 0x25c1d8, 0x20000000, 0x0,
0x22adc0), at 0xff2e7298
  [16] generateCodeForSplitPred(0xffbeea48, 0x2558f0, 0x25c1e8, 0x82c, 0x0,
0xa), at 0xff2e7518
  [17] genLoopEntryIfNeeded(0xffbeea48, 0x724, 0x82c, 0x0, 0x2558f0,
0xff337c00), at 0xff2a127c
  [18] JITLoopHandleBlockBoundary(0xffbeea48, 0x89d, 0x727, 0x237e08, 0x82c,
0x0), at 0xff2e7730
  [19] JITSecondPass(0xffbeea48, 0x1fff, 0x1, 0xffffffff, 0x225a64, 0x724), at
0xff2bfd4c
  [20] JITCompile_md(0xffbeea48, 0xffbee994, 0x2c, 0xffbee80c, 0x0, 0x22b410),
at 0xff2ae2b4
  [21] jitCompileMethod(0x225848, 0x0, 0xff29b480, 0x0, 0x2262e4, 0x0), at
0xff29b544
  [22] compileMethodLocked(0x225848, 0x0, 0xff337b14, 0x225848, 0x0,
0xff3350c8), at 0xff298e14
  [23] countingInvoker(0x2258a8, 0x225848, 0x1, 0x39c88, 0xffbeee64, 0xcd), at
0xff17d26c
  [24] executeJava(0x5, 0x39c88, 0xff3534a8, 0x39e5c, 0x225848, 0x224760), at
0xff236130
  [25] runJavaMethod(0x39c88, 0x39f00, 0xffbeef60, 0xf08a2, 0x39f00, 0x1), at
0xff1ab6a0
  [26] jni_Invoke(0xf08a2, 0x39f00, 0x0, 0x39c88, 0xffbef064, 0xff1aeb1c), at
0xff1aeff8
  [27] jni_CallStaticVoidMethod(0x39e88, 0x39ef4, 0x2257b0, 0x39c88, 0x1, 0x0)



stepping through the code

(dbx) cont; where
t@1 (l@1) stopped in genCodeForLoopValue at 0xfee5069c
0xfee5069c: genCodeForLoopValue : save %sp, -0xd8, %sp
current thread: t@1
=>[1] genCodeForLoopValue(0xffbee800, 0x473998, 0x20000000, 0xffbee800,
0x479390, 0xc0010003), at 0xfee5069c
  [2] generateCodeForSplitPred(0xffbee800, 0x473998, 0x47a280,
0x20000000, 0x0, 0x449bb0), at 0xfee514d4
  [3] generateCodeForSplitPred(0xffbee800, 0x473998, 0x47a290, 0x82c,
0x0, 0xa), at 0xfee51754
  [4] genLoopEntryIfNeeded(0xffbee800, 0x724, 0x82c, 0x0, 0x473998,
0xfefaac00), at 0xfee0bc34
  [5] JITLoopHandleBlockBoundary(0xffbee800, 0x89d, 0x727, 0x48a3f0,
0x82c, 0x0), at 0xfee5196c
  [6] JITSecondPass(0xffbee800, 0x1fff, 0x1, 0xffffffff, 0x445a64,
0x724), at 0xfee2a6e8
  [7] JITCompile_md(0xffbee800, 0xffbee74c, 0x2c, 0xffbee5c4, 0x0,
0x44a200), at 0xfee18ddc
  [8] jitCompileMethod(0x445848, 0x0, 0xfee05e68, 0x0, 0x0, 0x0), at
0xfee05f2c
  [9] compileMethodLocked(0x445848, 0x0, 0xfefaa9d4, 0x445848, 0x0,
0xfefa80c8), at 0xfee037fc
  [10] countingInvoker(0x4458a8, 0x445848, 0x1, 0x39da0, 0xffbeec1c,
0xcd), at 0xfecedb90
  [11] executeJava(0x5, 0x39da0, 0xfeff1a90, 0x39f5c, 0x445848,
0x444760), at 0xfeda4cc0
  [12] runJavaMethod(0x39da0, 0x39ff8, 0xffbeed18, 0xef5d2, 0x39ff8,
0x1), at 0xfed1bde8
  [13] jni_Invoke(0xef5d2, 0x39ff8, 0x0, 0x39da0, 0xffbeee1c,
0xfed1f264), at 0xfed1f740
  [14] jni_CallStaticVoidMethod(0x39f88, 0x39fec, 0x4457b0, 0x39da0,
0x1, 0x0), at 0xfed30430
  [15] main(0x39f88, 0x0, 0x39ff4, 0x4457b0, 0x39fec, 0x0), at 0x11998

(dbx) cont; where
t@1 (l@1) signal SEGV (access to address exceeded protections) in
genCodeForLoopValue at 0xfee50894
0xfee50894: genCodeForLoopValue+0x01f8: stb %o4, [%o0 + 0x1]
current thread: t@1
=>[1] genCodeForLoopValue(0x0, 0x473998, 0xffbee800, 0xffbee800,
0x479390, 0x20000000), at 0xfee50894
  [2] generateCodeForSplitPred(0xffbee800, 0x473998, 0x47a280,
0x20000000, 0x0, 0x449bb0), at 0xfee514d4
  [3] generateCodeForSplitPred(0xffbee800, 0x473998, 0x47a290, 0x82c,
0x0, 0xa), at 0xfee51754
  [4] genLoopEntryIfNeeded(0xffbee800, 0x724, 0x82c, 0x0, 0x473998,
0xfefaac00), at 0xfee0bc34
  [5] JITLoopHandleBlockBoundary(0xffbee800, 0x89d, 0x727, 0x48a3f0,
0x82c, 0x0), at 0xfee5196c
  [6] JITSecondPass(0xffbee800, 0x1fff, 0x1, 0xffffffff, 0x445a64,
0x724), at 0xfee2a6e8
  [7] JITCompile_md(0xffbee800, 0xffbee74c, 0x2c, 0xffbee5c4, 0x0,
0x44a200), at 0xfee18ddc
  [8] jitCompileMethod(0x445848, 0x0, 0xfee05e68, 0x0, 0x0, 0x0), at
0xfee05f2c
  [9] compileMethodLocked(0x445848, 0x0, 0xfefaa9d4, 0x445848, 0x0,
0xfefa80c8), at 0xfee037fc
  [10] countingInvoker(0x4458a8, 0x445848, 0x1, 0x39da0, 0xffbeec1c,
0xcd), at 0xfecedb90
  [11] executeJava(0x5, 0x39da0, 0xfeff1a90, 0x39f5c, 0x445848,
0x444760), at 0xfeda4cc0
  [12] runJavaMethod(0x39da0, 0x39ff8, 0xffbeed18, 0xef5d2, 0x39ff8,
0x1), at 0xfed1bde8
  [13] jni_Invoke(0xef5d2, 0x39ff8, 0x0, 0x39da0, 0xffbeee1c,
0xfed1f264), at 0xfed1f740
  [14] jni_CallStaticVoidMethod(0x39f88, 0x39fec, 0x4457b0, 0x39da0,
0x1, 0x0), at 0xfed30430
  [15] main(0x39f88, 0x0, 0x39ff4, 0x4457b0, 0x39fec, 0x0), at 0x11998

You can see from the error
t@1 (l@1) signal SEGV (access to address exceeded protections) in
genCodeForLoopValue at 0xfee50894
0xfee50894: genCodeForLoopValue+0x01f8: stb %o4, [%o0 + 0x1]


Appears that the JVM is attempting to write to memory it does not have access to.