VM crashes duirng processing StringTable. There are a crashes on different platforms.
All crashes are with CMS and iCMS only.

The hs_err (linux) is:
;; Using jvm: "/export/local/common/jdk/baseline/linux-i586/jre/lib/i386/client/libjvm.so"
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0xb78647a8, pid=18261, tid=2937469840
#
# JRE version: 7.0-b136
# Java VM: Java HotSpot(TM) Client VM (21.0-b06 mixed mode linux-x86 )
# Problematic frame:
# V [libjvm.so+0x37e7a8] ParRootScanWithoutBarrierClosure::do_oop(oopDesc**)+0x38
#
# Core dump written. Default location: /export/local/78616.JDK7.PROMOTION.VM.PERMGEN+linux-i586_bigapps__client_mixed_runThese/results/runThese/core or core.18261
#
# If you would like to submit a bug report, please visit:
# http://java.sun.com/webapps/bugreport/crash.jsp
#

--------------- T H R E A D ---------------

Current thread (0x084c1400): GCTaskThread [stack: 0x00000000,0x00000000] [id=18275]

siginfo:si_signo=SIGSEGV: si_errno=0, si_code=1 (SEGV_MAPERR), si_addr=0x00780084;;

Registers:
EAX=0x00000000, EBX=0x6bb40658, ECX=0x08603208, EDX=0x00780078
ESP=0xaf162fe0, EBP=0xaf162ff8, ESI=0x00780080, EDI=0x0a6e5e6c
EIP=0xb78647a8, EFLAGS=0x00210293, CR2=0x00780084

Top of Stack: (sp=0xaf162fe0)
0xaf162fe0: 084bb800 583fbf54 00780078 b79b8628
0xaf162ff0: 583fbf4c 08603818 af163028 b78d317d
0xaf163000: 0a6e5e6c 583fbf54 08603818 08603818
0xaf163010: b799aaa8 b799aa28 00000184 0a6e5e6c
0xaf163020: 00000001 084bf7f0 af163068 b789ee99
0xaf163030: 0a6e5e6c 00000008 00000001 00000001
0xaf163040: b7f4d63c 00000000 00000000 b79b8628
0xaf163050: b7f49d32 084c2240 00163088 0a6e5d01

Instructions: (pc=0xb78647a8)
0xb7864788: a2 00 00 00 39 5f 24 0f 86 99 00 00 00 8b 03 8b
0xb7864798: 53 04 89 45 f0 83 e0 03 83 f8 03 74 63 8d 72 08
0xb78647a8: 8b 4e 04 83 f9 00 0f 8e b4 00 00 00 f6 c1 01 75
0xb78647b8: 7f 89 c8 c1 f8 02 8b 57 1c 8b 4f 20 80 3d 14 f4
;; b7864798 53 push %ebx
;; b7864799 04 89 add $0x89,%al
;; b786479b 45 inc %ebp
;; b786479c f0 83 e0 03 lock and $0x3,%eax
;; b78647a0 83 f8 03 cmp $0x3,%eax
;; b78647a3 74 63 je 0xb7864808
;; b78647a5 8d 72 08 lea 0x8(%edx),%esi
;; ---------------
;; b78647a8 8b 4e 04 mov 0x4(%esi),%ecx
;; b78647ab 83 f9 00 cmp $0x0,%ecx
;; b78647ae 0f 8e b4 00 00 00 jle 0xb7864868
;; b78647b4 f6 c1 01 test $0x1,%cl
;; b78647b7 75 7f jne 0xb7864838
;; b78647b9 89 c8 mov %ecx,%eax
;; b78647bb c1 f8 02 sar $0x2,%eax
;; b78647be 8b 57 1c mov 0x1c(%edi),%edx
;; b78647c1 8b 4f 20 mov 0x20(%edi),%ecx
;; b78647c4 80 3d 14 f4 ff ff ff cmpb $0xff,0xfffff414
;;
Register to memory mapping:

EAX=0x00000000 is an unknown value
EBX=0x6bb40658 is an oop
[C
 - klass: {type array char}
 - length: 441599
ECX=0x08603208 is an unknown value
EDX=0x00780078 is an unknown value
ESP=0xaf162fe0 is an unknown value
EBP=0xaf162ff8 is an unknown value
ESI=0x00780080 is an unknown value
EDI=0x0a6e5e6c is an unknown value


Stack: [0x00000000,0x00000000], sp=0xaf162fe0, free space=2868619k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x37e7a8] ParRootScanWithoutBarrierClosure::do_oop(oopDesc**)+0x38;; ParRootScanWithoutBarrierClosure::do_oop(oopDesc**)+0x38
V [libjvm.so+0x3ed17d] StringTable::oops_do(OopClosure*)+0x5d;; StringTable::oops_do(OopClosure*)+0x5d
V [libjvm.so+0x3b8e99] SharedHeap::process_strong_roots(bool, bool, SharedHeap::ScanningOption, OopClosure*, CodeBlobClosure*, OopsInGenClosure*)+0x219;; SharedHeap::process_strong_roots(bool, bool, SharedHeap::ScanningOption, OopClosure*, CodeBlobClosure*, OopsInGenClosure*)+0x219
V [libjvm.so+0x203c5b] GenCollectedHeap::gen_process_strong_roots(int, bool, bool, bool, SharedHeap::ScanningOption, OopsInGenClosure*, bool, OopsInGenClosure*)+0x5b;; GenCollectedHeap::gen_process_strong_roots(int, bool, bool, bool, SharedHeap::ScanningOption, OopsInGenClosure*, bool, OopsInGenClosure*)+0x5b
V [libjvm.so+0x37b357] ParNewGenTask::work(int)+0xa7;; ParNewGenTask::work(int)+0xa7
V [libjvm.so+0x462669] GangWorker::loop()+0x99;; GangWorker::loop()+0x99
V [libjvm.so+0x461fe8] GangWorker::run()+0x18;; GangWorker::run()+0x18
V [libjvm.so+0x371cc1] java_start(Thread*)+0x111;; _ZL10java_startP6Thread+0x111
C [libpthread.so.0+0x573b] start_thread+0xcb


The hs_err (windows) is:
#
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x729b00c9, pid=138808, tid=19704
#
# JRE version: 7.0-b136
# Java VM: Java HotSpot(TM) Client VM (21.0-b06 compiled mode windows-x86 )
# Problematic frame:
# V [jvm.dll+0x100c9]
#
# Failed to write core dump. Minidumps are not enabled by default on client versions of Windows
#
# If you would like to submit a bug report, please visit:
# http://java.sun.com/webapps/bugreport/crash.jsp
#

--------------- T H R E A D ---------------

Current thread (0x02494c00): GCTaskThread [stack: 0x00000000,0x00000000] [id=19704]

siginfo: ExceptionCode=0xc0000005, reading address 0x0000000c;;
;; si_signo=0xc0000005 EXCEPTION_ACCESS_VIOLATION /* The thread tried to read from or write to a virtual address for which it does not have the appropriate access. */

Registers:
EAX=0x00000008, EBX=0x64a6db00, ECX=0x00000008, EDX=0x72c2e698
ESP=0x0aaaf6c0, EBP=0x0aaaf6c4, ESI=0x12088840, EDI=0x00000000
EIP=0x729b00c9, EFLAGS=0x00010202

Top of Stack: (sp=0x0aaaf6c0)
0x0aaaf6c0: 12088840 0aaaf6dc 72bb71f5 00000008
0x0aaaf6d0: 02540bd4 645de714 645de71c 0aaaf6f8
0x0aaaf6e0: 729c6d51 645de71c 64a6db00 02496a38
0x0aaaf6f0: 02496a01 00000099 0aaaf710 72a0d789
0x0aaaf700: 64a6db00 64a6db00 64a6db28 02496a38
0x0aaaf710: 0aaaf750 72a0792f 00000000 00000000
0x0aaaf720: 00000001 64a6db00 0aaaf73c 64a6db28
0x0aaaf730: 02496268 64a6da40 5f90f8b4 72bfbdb4

Instructions: (pc=0x729b00c9)
0x729b00a9: 75 59 23 00 83 c4 0c 5d c2 04 00 cc cc cc cc cc
0x729b00b9: cc cc cc cc cc cc cc 55 8b ec 56 8b f1 8b 4d 08
0x729b00c9: 8b 41 04 85 c0 7e 0c a8 01 75 36 c1 f8 02 5e 5d
0x729b00d9: c2 04 00 79 2c 8b 76 08 8b 15 9c 58 c6 72 8b c8
(*****) Only runs on Solaris or Linux
;;

Register to memory mapping:

EAX=0x00000008 is an unknown value
EBX=0x64a6db00 is an unknown value
ECX=0x00000008 is an unknown value
EDX=0x72c2e698 is an unknown value
ESP=0x0aaaf6c0 is an unknown value
EBP=0x0aaaf6c4 is an unknown value
ESI=
[error occurred during error reporting (printing register info), id 0xc0000005]

Stack: [0x00000000,0x00000000], sp=0x0aaaf6c0, free space=174781k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [jvm.dll+0x100c9];; ?size_given_klass@oopDesc@@QAEHPAVKlass@@@Z+0x9
V [jvm.dll+0x2171f5];; ?do_oop@ParRootScanWithoutBarrierClosure@@UAEXPAPAVoopDesc@@@Z+0x45
V [jvm.dll+0x26d51];; ?oops_do@StringTable@@SAXPAVOopClosure@@@Z+0x31
V [jvm.dll+0x6d789];; ?process_strong_roots@SharedHeap@@QAEX_N0W4ScanningOption@1@PAVOopClosure@@PAVCodeBlobClosure@@PAVOopsInGenClosure@@@Z+0x149
V [jvm.dll+0x6792f];; ?gen_process_strong_roots@GenCollectedHeap@@QAEXH_N00W4ScanningOption@SharedHeap@@PAVOopsInGenClosure@@02@Z+0x6f
V [jvm.dll+0x215315];; ?work@ParNewGenTask@@UAEXH@Z+0x95
V [jvm.dll+0x15c8f7];; ?loop@GangWorker@@MAEXXZ+0x87
V [jvm.dll+0x16a7b9];; ?java_start@@YGIPAVThread@@@Z+0x99
C [msvcr100.dll+0x5c6de] endthreadex+0x3a
C [msvcr100.dll+0x5c788] endthreadex+0xe4
C [kernel32.dll+0x8eccb] BaseThreadInitThunk+0xe
C [ntdll.dll+0x7d80d] RtlCreateUserProcess+0x8c
C [ntdll.dll+0x7da1f] RtlCreateProcessParameters+0x4e


--------------- P R O C E S S ---------------

Java Threads: ( => current thread )
  0x61ebd800 JavaThread "$TESTBASE/jck/jck-15a/JCK/javatest.jar;$TESTBASE/jck/jck-15a/JCK/classes javasoft.sqe.tests.api.java.nio.charset.Charset.UTF16LETests -TestCaseID ALL" daemon [_thread_blocked, id=109600, stack(0x66350000,0x663a0000)]
  0x61c64800 JavaThread "Thread-6775" daemon [_thread_in_native, id=80380, stack(0x66680000,0x666d0000)]
  0x61ebdc00 JavaThread "Keep-Alive-SocketCleaner" daemon [_thread_blocked, id=97316, stack(0x641a0000,0x641f0000)]
  0x61ebd000 JavaThread "Thread-2173" daemon [_thread_blocked, id=75540, stack(0x66480000,0x664d0000)]
  0x62207c00 JavaThread "Thread-2172" daemon [_thread_blocked, id=71528, stack(0x662e0000,0x66330000)]
  0x62207000 JavaThread "Thread-2171" daemon [_thread_blocked, id=61164, stack(0x62be0000,0x62c30000)]
  0x62208000 JavaThread "Thread-2170" daemon [_thread_blocked, id=73620, stack(0x66220000,0x66270000)]
  0x63f46800 JavaThread "Thread-2169" daemon [_thread_blocked, id=70284, stack(0x60850000,0x608a0000)]
  0x63f48800 JavaThread "Thread-2168" daemon [_thread_blocked, id=68044, stack(0x64120000,0x64170000)]
  0x63f47000 JavaThread "Thread-2162" daemon [_thread_blocked, id=66656, stack(0x62a30000,0x62a80000)]
  0x63f48400 JavaThread "AWT-EventQueue-0" [_thread_blocked, id=62588, stack(0x60980000,0x609d0000)]
  0x62206800 JavaThread "AWT-Shutdown" [_thread_blocked, id=65728, stack(0x61520000,0x61570000)]
  0x63ba7800 JavaThread "Swing-Shell" daemon [_thread_blocked, id=33280, stack(0x640d0000,0x64120000)]
  0x61c65800 JavaThread "Thread-62" daemon [_thread_blocked, id=44940, stack(0x61770000,0x617c0000)]
  0x61c66c00 JavaThread "Thread-61" daemon [_thread_blocked, id=25500, stack(0x62d60000,0x62db0000)]
  0x61c66000 JavaThread "SwingWorker-pool-1-thread-1" daemon [_thread_blocked, id=42348, stack(0x62b10000,0x62b60000)]
  0x61d40800 JavaThread "Thread-27" daemon [_thread_in_native, id=40444, stack(0x60610000,0x60660000)]
  0x60a75c00 JavaThread "TimerQueue" daemon [_thread_blocked, id=41908, stack(0x61580000,0x615d0000)]
  0x600ee000 JavaThread "AWT-Windows" daemon [_thread_in_native, id=9280, stack(0x608a0000,0x608f0000)]
  0x600ea800 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=34684, stack(0x60440000,0x60490000)]
  0x60025800 JavaThread "Thread-2" daemon [_thread_blocked, id=24968, stack(0x604a0000,0x604f0000)]
  0x6001d800 JavaThread "ControllerThread" daemon [_thread_blocked, id=253700, stack(0x603e0000,0x60430000)]
  0x5f7afc00 JavaThread "Service Thread" daemon [_thread_blocked, id=37476, stack(0x5fe00000,0x5fe50000)]
  0x5f782400 JavaThread "C1 CompilerThread0" daemon [_thread_blocked, id=246484, stack(0x5fbb0000,0x5fc00000)]
  0x5f77fc00 JavaThread "Attach Listener" daemon [_thread_blocked, id=36164, stack(0x5fc40000,0x5fc90000)]
  0x5f776c00 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=23180, stack(0x5fa60000,0x5fab0000)]
  0x5f775c00 JavaThread "Surrogate Locker Thread (Concurrent GC)" daemon [_thread_blocked, id=39384, stack(0x5f4e0000,0x5f530000)]
  0x5f70e400 JavaThread "Finalizer" daemon [_thread_blocked, id=35156, stack(0x5f9a0000,0x5f9f0000)]
  0x5f70a000 JavaThread "Reference Handler" daemon [_thread_blocked, id=37000, stack(0x02660000,0x026b0000)]
  0x0259dc00 JavaThread "main" [_thread_blocked, id=39536, stack(0x026b0000,0x02700000)]