SIGSEGV in MarkSweep::follow_stack()

VM crashes with

# SIGSEGV (0xb) at pc=0xb6ff9e67, pid=17461, tid=2958179184
#
# JRE version: 7.0-b147
# Java VM: Java HotSpot(TM) Server VM (23.0-b08-internal-201112131853.jmasa.hg_gc_merge mixed mode, sharing linux-x86 )
# Problematic frame:
# V [libjvm.so+0x52be67] MarkSweep::follow_stack()+0x227
#
# Core dump written. Default location: /export/local/56935.JDK7.NIGHTLY.VM_linux-i586_vm_server_mixed_vm.gc.testlist/results/ResultDir/Humongous_Arrays/core or core.17461
#
# If you would like to submit a bug report, please visit:
# http://bugreport.sun.com/bugreport/crash.jsp
#

--------------- T H R E A D ---------------

Current thread (0x08b73000): VMThread [stack: 0xb04a3000,0xb0524000] [id=17466]

siginfo:si_signo=SIGSEGV: si_errno=0, si_code=1 (SEGV_MAPERR), si_addr=0x00000004;;

Registers:
EAX=0x7e22883c, EBX=0x00000004, ECX=0x08c23c20, EDX=0x0000fa00
ESP=0xb0522c00, EBP=0xb0522c38, ESI=0x00000000, EDI=0x7e228648
EIP=0xb6ff9e67, EFLAGS=0x00210202, CR2=0x00000004

Top of Stack: (sp=0xb0522c00)
0xb0522c00: 08b733b4 08b7378c 00000003 0001f2f0
0xb0522c10: 0000fa00 7e22883c 7e1ea030 b6ffa359
0xb0522c20: 8f36a428 8022bf70 8f36a420 b76a3ed4
0xb0522c30: b72944f4 08b52400 b0522c58 b718eae4
0xb0522c40: b72944f4 b76a3e7c 00000010 00000010
0xb0522c50: b72944f4 00000002 b0522c98 b70f3f82
0xb0522c60: b72944f4 00000000 00000000 00000000
0xb0522c70: b7827f27 00000000 01829319 b6aa7080

Instructions: (pc=0xb6ff9e67)
0xb6ff9e47: 89 1c 90 a1 90 43 29 b7 40 a3 90 43 29 b7 83 c7
0xb6ff9e57: 04 39 7d dc 0f 86 a7 fe ff ff 8b 1f 85 db 74 ee
0xb6ff9e67: 8b 03 83 e0 03 83 f8 03 74 e4 8b 33 c7 45 f0 03
0xb6ff9e77: 00 00 00 8b 45 f0 89 03 80 3d 0d aa 27 b7 00 0f
;; b6ff9e57 04 39 add $0x39,%al
;; b6ff9e59 7d dc jge 0xb6ff9e37
;; b6ff9e5b 0f 86 a7 fe ff ff jbe 0xb6ff9d08
;; b6ff9e61 8b 1f mov (%edi),%ebx
;; b6ff9e63 85 db test %ebx,%ebx
;; b6ff9e65 74 ee je 0xb6ff9e55
;; ---------------
;; b6ff9e67 8b 03 mov (%ebx),%eax
;; b6ff9e69 83 e0 03 and $0x3,%eax
;; b6ff9e6c 83 f8 03 cmp $0x3,%eax
;; b6ff9e6f 74 e4 je 0xb6ff9e55
;; b6ff9e71 8b 33 mov (%ebx),%esi
;; b6ff9e73 c7 45 f0 03 00 00 00 movl $0x3,0xfffffff0(%ebp)
;; b6ff9e7a 8b 45 f0 mov 0xfffffff0(%ebp),%eax
;; b6ff9e7d 89 03 mov %eax,(%ebx)
;; b6ff9e7f 80 3d 0d aa 27 b7 00 cmpb $0x0,0xb727aa0d
;; b6ff9e86 0f ff (bad)
;;
Register to memory mapping:

EAX=0x7e22883c is an oop
[Ljava.lang.Object;
 - klass: 'java/lang/Object'[]
 - length: 127728
EBX=0x00000004 is an unknown value
ECX=0x08c23c20 is an unknown value
EDX=0x0000fa00 is an unknown value
ESP=0xb0522c00 is an unknown value
EBP=0xb0522c38 is an unknown value
ESI=0x00000000 is an unknown value
EDI=0x7e228648 is an oop
[Ljava.lang.Object;
 - klass: 'java/lang/Object'[]
 - length: 127728


Stack: [0xb04a3000,0xb0524000], sp=0xb0522c00, free space=511k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.so+0x52be67] MarkSweep::follow_stack()+0x227;; MarkSweep::follow_stack()+0x227
V [libjvm.so+0x6c0ae4] Universe::oops_do(OopClosure*, bool)+0x474;; Universe::oops_do(OopClosure*, bool)+0x474
V [libjvm.so+0x625f82] SharedHeap::process_strong_roots(bool, bool, SharedHeap::ScanningOption, OopClosure*, CodeBlobClosure*, OopsInGenClosure*)+0x2a2;; SharedHeap::process_strong_roots(bool, bool, SharedHeap::ScanningOption, OopClosure*, CodeBlobClosure*, OopsInGenClosure*)+0x2a2
V [libjvm.so+0x37b35b] GenCollectedHeap::gen_process_strong_roots(int, bool, bool, bool, SharedHeap::ScanningOption, OopsInGenClosure*, bool, OopsInGenClosure*)+0x5b;; GenCollectedHeap::gen_process_strong_roots(int, bool, bool, bool, SharedHeap::ScanningOption, OopsInGenClosure*, bool, OopsInGenClosure*)+0x5b
V [libjvm.so+0x37dfdf] GenMarkSweep::mark_sweep_phase1(int, bool)+0x7f;; GenMarkSweep::mark_sweep_phase1(int, bool)+0x7f
V [libjvm.so+0x37e5d5] GenMarkSweep::invoke_at_safepoint(int, ReferenceProcessor*, bool)+0x105;; GenMarkSweep::invoke_at_safepoint(int, ReferenceProcessor*, bool)+0x105
V [libjvm.so+0x389921] OneContigSpaceCardGeneration::collect(bool, bool, unsigned int, bool)+0x41;; OneContigSpaceCardGeneration::collect(bool, bool, unsigned int, bool)+0x41
V [libjvm.so+0x37d19d] GenCollectedHeap::do_collection(bool, bool, unsigned int, bool, int)+0x53d;; GenCollectedHeap::do_collection(bool, bool, unsigned int, bool, int)+0x53d
V [libjvm.so+0x27c8ca] GenCollectorPolicy::satisfy_failed_allocation(unsigned int, bool)+0x14a;; GenCollectorPolicy::satisfy_failed_allocation(unsigned int, bool)+0x14a
V [libjvm.so+0x6e7b94] VM_GenCollectForAllocation::doit()+0x74;; VM_GenCollectForAllocation::doit()+0x74
V [libjvm.so+0x6efda1] VM_Operation::evaluate()+0x41;; VM_Operation::evaluate()+0x41
V [libjvm.so+0x6ee748] VMThread::evaluate_operation(VM_Operation*)+0x78;; VMThread::evaluate_operation(VM_Operation*)+0x78
V [libjvm.so+0x6eec87] VMThread::loop()+0x1a7;; VMThread::loop()+0x1a7
V [libjvm.so+0x6ef315] VMThread::run()+0x85;; VMThread::run()+0x85
V [libjvm.so+0x5ac121] java_start(Thread*)+0x111;; java_start(Thread*)+0x111
C [libpthread.so.0+0x596e] start_thread+0xbe