JLI Instrumentation.redefineClasses SIGSEGVs on java/lang/Thread

I was archiving the revised test from 5003341 when I ran it on Mustang/6.0
bits instead of on Tiger/1.5.0 bits. To my surprise, the test crashed. Here
are snippets from the doit logs from both product and fastdebug bits:

::::::::::::::
doit-160-fcs.log
::::::::::::::
<snip>
# SIGSEGV (0xb) at pc=0xd18891ed, pid=935, tid=7
#
# Java VM: Java HotSpot(TM) Client VM (1.6.0-b105 mixed mode)
# Problematic frame:
# V [libjvm.so+0x891ed]
#
<snip>

::::::::::::::
doit-160-fcs-fast.log
::::::::::::::
<snip>
# Internal Error (/export0/BUILD_AREA/jdk6.0/hotspot/src/share/vm/runtime/classFileParser.hpp, 142), pid=948, tid=7
#
# Java VM: Java HotSpot(TM) Client VM (1.6.0-fastdebug-b105-debug mixed mode)
#
# Error: Invalid code attribute name index %u in class file %s
<snip>

Here is a stack trace snippet from the product bits crash (SIGSEGV):

::::::::::::::
threads-160-fcs.log
::::::::::::::
<snip>

THREAD t@7
<snip>
  [9] __sighndlr(0xb, 0xcf1fb038, 0xcf1fae38, 0xd1911c78), at 0xd1f3014f
  ---- called from signal handler with signal 11 (SIGSEGV) ------
  [10] SignatureIterator::expect(0xcf1fb104, 0x28), at 0xd18891ed
  [11] SignatureIterator::iterate_parameters(0xcf1fb104), at 0xd1889183
  [12] methodOopDesc::compute_size_of_parameters(0xcb1b4168, 0x8115000), at 0xd188910d
  [13] ClassFileParser::parse_method(0xcf1fb360, 0xcf1fb5ac, 0x8115794, 0x0, 0xcf1fb510, 0xcf1fb340, 0xcf1fb344, 0xcf1fb348), at 0xd198a39d
  [14] ClassFileParser::parse_methods(0xcf1fb520, 0xcf1fb5ac, 0x8115794, 0x0, 0xcf1fb510, 0xcf1fb50c, 0xcf1fb514, 0xcf1fb518, 0xcf1fb51c), at 0xd198b19d
  [15] ClassFileParser::parseClassFile(0xcf1fb65c, 0xcf1fb5ac, 0x8115780, 0x0, 0x0, 0xcf1fb658), at 0xd1883fc8
  [16] SystemDictionary::parse_stream(0x8115780, 0x0, 0x0, 0xcf1fb6bc, 0x8115000), at 0xd1b1c365
  [17] VM_RedefineClasses::load_new_class_versions(0xcf1fb870, 0x8115000), at 0xd1a97917
  [18] VM_RedefineClasses::doit_prologue(0xcf1fb870), at 0xd1a958d8
  [19] VMThread::execute(0xcf1fb870), at 0xd18e5a0c
  [20] JvmtiEnv::RedefineClasses(0x806e4e0, 0x1, 0x810ef40), at 0xd1a7f804
  [21] jvmti_RedefineClasses(0x806e4e0, 0x1, 0x810ef40), at 0xd1a6bf80
  [22] redefineClasses(0x81150e8, 0x806e5d8, 0xcf1fba0c), at 0xd16d458e
  [23] Java_sun_instrument_InstrumentationImpl_redefineClasses0(0x81150e8, 0xcf1fba18, 0x806e5d8, 0x0, 0xcf1fba0c, 0x102, 0xcb1b23a8, 0xcf1fb9dc, 0xcb168614, 0xcf1fba18, 0xcb168ff0, 0x0, 0xcb168618, 0x0, 0xcf1fba0c, 0xcf1fba3c, 0xcf402e9d,
0x0, 0xcf408159, 0xc7072db0), at 0xd16d1543
  [24] 0xcf40a08b(0x0, 0xcf408159, 0xc7072db0, 0x806e5d8, 0x0, 0xc7025428), at 0xcf40a08b
<snip>

Here is a stack trace snippet from the fastdebug bits crash (assert failure):

::::::::::::::
threads-160-fcs-fast.log
::::::::::::::
<snip>
THREAD t@7

<snip>
  [7] report_fatal(0xd1716344, 0x8e, 0xd1716390), at 0xd0e9c4f3
  [8] ClassFileParser::parse_method(0xce4c6ae0, 0xce4c732c, 0x81666a8, 0x0, 0xce4c6e70, 0xce4c6a9c, 0xce4c6aa0, 0xce4c6aa4), at 0xd0deed58
  [9] ClassFileParser::parse_methods(0xce4c6e80, 0xce4c732c, 0x81666a8, 0x0, 0xce4c6e70, 0xce4c6e6c, 0xce4c6e74, 0xce4c6e78, 0xce4c6e7c), at 0xd0df0230
  [10] ClassFileParser::parseClassFile(0xce4c73d8, 0xce4c732c, 0x816669dbx: warning: can't find file "/export0/BUILD_AREA/jdk6.0/control/build/solaris-i586-fastdebug/hotspot/outputdir/solaris_i486_compiler1/fastdebug/compileBroker.o"
dbx: warning: can't find file "/export0/BUILD_AREA/jdk6.0/control/build/solaris-i586-fastdebug/hotspot/outputdir/solaris_i486_compiler1/fastdebug/lowMemoryDetector.o"
4, 0x0, 0x0, 0xce4c73d4), at 0xd0dfd4eb
  [11] SystemDictionary::parse_stream(0xce4c76b0, 0x8166694, 0x0, 0x0, 0xce4c745c, 0x815f800), at 0xd1422b41
  [12] VM_RedefineClasses::load_new_class_versions(0xce4c7820, 0x815f800), at 0xd1243add
  [13] VM_RedefineClasses::doit_prologue(0xce4c7820), at 0xd1239de7
  [14] VMThread::execute(0xce4c7820), at 0xd1553daa
  [15] JvmtiEnv::RedefineClasses(0x806ed70, 0x1, 0x816d268), at 0xd11f1e2c
  [16] jvmti_RedefineClasses(0x806ed74, 0x1, 0x816d268), at 0xd1120d7b
=>[17] redefineClasses(jnienv = ???, agent = ???, classDefinitions = ???) (optimized), at 0xd097472e (line ~1201) in "JPLISAgent.c"
  [18] Java_sun_instrument_InstrumentationImpl_redefineClasses0(jnienv = ???, implThis = ???, agent = ???, classDefinitions = ???) (optimized), at 0xd09716e3 (line ~83) in "InstrumentationImplNativeMethods.c"
  [19] 0xce80cfe6(0x0, 0xce809fc9, 0xc647e5e0, 0x806f450, 0x0, 0xc6425cf8), at 0xce80cfe6
<snip>

The testcase is attached as testcase.tgz. The various logs are attached as logs.tgz.
Also reproduced with Dolphin-B11 bits. Looks like the same crash
and assertion failure, but I didn't generate thread dumps and stuff.
The failure does not reproduce with Tiger/1.5.0_08 bits on my laptop
or with Tiger/1.5.0_12 bits on producer.