GC crash in ParRootScanWithoutBarrierClosure::do_oop

Customers application is crashing daily in GC.

The original stack trace is
----------------- lwp# 3 / thread# 3 --------------------
 ffffffff7efa6f3c _lwp_kill (6, 0, ffffffff392fdb60, 7fbffeff00003ff6, 0, 2) + 8
 ffffffff7ef3d2e0 abort (0, ffffffff392fdc40, 0, fffffffffffffff8, 0, ffffffff392fdc69) + 100
 ffffffff7e90951c void os::abort(int) (1, ffffffff7e9d295c, ffffffff392fdd40, ffffffff7e9d24a9, 4b007c, ffffffff7eb78878) + 84
 ffffffff7e907e08 void os::handle_unexpected_exception(Thread*,int,unsigned char*,void*) (0, a, ffffffff7e9150d0, ffffffff392fece0, ffffffff7e69c6f8, 0) + 270
 ffffffff7e69c800 JVM_handle_solaris_signal (ffffffff392fece0, ffffffff7e9d443e, ffffffff392fea00, 1, 0, 1) + 8e0
 ffffffff7f218ae4 __sighndlr (a, ffffffff392fece0, ffffffff392fea00, ffffffff7e69cb9c, 0, 0) + c
 ffffffff7f212718 call_user_handler (ffffffff7ed00800, ffffffff392fece0, ffffffff392fea00, 0, 0, 0) + 25c
 ffffffff7f2128dc sigacthandler (a, ffffffff392fece0, ffffffff392fea00, 10, 1, 0) + 68
 --- called from signal handler with signal 10 (SIGBUS) ---
 ffffffff7e9150d0 void ParRootScanWithoutBarrierClosure::do_oop(oopDesc**) (ffffffff392ff960, fffffffe83fff4b0, 35a, ffffffff392ff030, ffffffff3940b6ac, ffffffff392fef50) + 34
 ffffffff7e90637c void InterpreterOopMap::iterate_oop(OffsetClosure*) (ffffffff392ff030, ffffffff392ff050, ffffffff392ff030, 0, ffffffff7e608aa4, ffffffff392ff060) + 7c
 ffffffff7e629064 void frame::oops_interpreted_do(OopClosure*,const RegisterMap*) (ffffffff29a0e2e0, 35a, 20, 392ff960, 0, 0) + 1a4
 ffffffff7e64d700 void JavaThread::oops_do(OopClosure*) (1010d9900, ffffffff392ff960, 0, ffffffffffffffff, 0, 0) + 120
 ffffffff7e954244 void Threads::possibly_parallel_oops_do(OopClosure*) (ffffffff392ff960, 1, ffffffff392ffa38, ffffffff392ff888, 9c30, 1dd408) + 84
 ffffffff7e6ab4d8 void GenCollectedHeap::process_strong_roots(int,int,int,GenCollectedHeap::ClassScanningOption,OopsInGenClosure*,OopsInGenClosure*) (10019b730, 0, 1, 0, 1, ffffffff392ff918) + a0
 ffffffff7e91481c void ParNewGenTask::work(int) (fffffffeb81ff5e0, 1, 0, 100172680, ffffffff7e96d530, 0) + 2f4
 ffffffff7e96d544 void GangWorker::run() (10019c270, 40, 0, 0, 0, 0) + a4
 ffffffff7e6cd64c _start (10019c270, 0, 0, 0, 0, 0) + ec
 ffffffff7f218814 _lwp_start (0, 0, 0, 0, 0, 0)
----------------- lwp# 4 / thread# 4 --------------------


customer agreed to test a fast debug build and the only one I had at the time was a 32 bit build so they ran with that.
the error log reported:

# An unexpected error has been detected by HotSpot Virtual Machine:
#
# Internal Error (/net/jpsesvr/jpse-US3/yq123930/tmp/hotspot142/hotspot142_09/src/share/vm/memory/cardTableModRefBS.hpp, 118 [ Patched ]), pid=11673, tid=3
#
# Java VM: Java HotSpot(TM) Server VM (1.4.2_20050817-debug mixed mode)
#
# Error: assert(_whole_heap.contains(p),"out of bounds access to card marking array")


more hotspot.log
<?xml version='1.0' encoding='UTF-8'?>
<hotspot_log version='142 1' process='11673' time_ms='1126289332399'>
<vm_version>
<name>
Java HotSpot(TM) Server VM
</name>
<release>
1.4.2_20050817-debug
</release>
<info>
Java HotSpot(TM) Server VM (1.4.2_20050817) for solaris-sparc, built on Aug 17 2005 19:58:01 by unknown with Workshop 5.2 compat=5
</info>
</vm_version>
<tty>
<writer thread='1'/>
[Verifying threads permgen concurrent mark-sweep generation par new generation remset syms strs zone dict hand C-heap ]
[Verifying threads permgen concurrent mark-sweep generation par new generation remset syms strs zone dict hand C-heap ]
<writer thread='5'/>
0.000: [GC 0.001: [ParNew VerifyBeforeGC:[Verifying threads permgen concurrent mark-sweep generation par new generation remset syms strs zone dict hand C-heap ]
<tty_done stamp='6.174'/>
</tty>
<hotspot_log_done stamp='6.174'/>
</hotspot_log>


----------------- lwp# 3 / thread# 3 --------------------
_lwp_kill (6, 0, fb77f198, 2ad08, fe4ac344, 0) + 8
abort (fb77f238, fee3a6eb, 1, 7efefeff, 81010100, ff00) + 100
void os::abort(int)
void VMError::report_and_die()
void report_assertion_failure(const char*,int,const char*)
void VMError::report(outputStream*)
void VMError::report_and_die()
void report_assertion_failure(const char*,int,const char*)
void CardTableModRefBS::get_LNC_array_for_space(Space*,signed char**&,unsigned&,unsigned&)
void CardTableModRefBS::par_non_clean_card_iterate_work(Space*,MemRegion,DirtyCardToOopClosure*,MemRegionClosure*,int,int)
void CardTableModRefBS::non_clean_card_iterate(Space*,MemRegion,DirtyCardToOopClosure*,MemRegionClosure*,int)
void CardTableRS::younger_refs_in_space_iterate(Space*,OopsInGenClosure*)
void ConcurrentMarkSweepGeneration::younger_refs_iterate(OopsInGenClosure*)
void GenCollectedHeap::process_strong_roots(int,int,int,GenCollectedHeap::ClassScanningOption,OopsInGenClosure*,OopsInGenClosure*)
void ParNewGenTask::work(int)
void GangWorker::run()
_start (c9610, 0, 0, 0, 0, 0) + 190
_lwp_start (0, 0, 0, 0, 0, 0)