Index: /trunk/src/VBox/VMM/TM.cpp
===================================================================
--- /trunk/src/VBox/VMM/TM.cpp	(revision 20088)
+++ /trunk/src/VBox/VMM/TM.cpp	(revision 20089)
@@ -1377,4 +1377,8 @@
     bool            fActive  = false;
     bool            fPending = false;
+
+    AssertMsg(   !pTimer->pCritSect
+              || VMR3GetState(pVM) != VMSTATE_RUNNING
+              || PDMCritSectIsOwner(pTimer->pCritSect), ("%s\n", pTimer->pszDesc));
 
     /*
@@ -2326,5 +2330,6 @@
  *
  * In strict builds, ownership of the critical section will be asserted by
- * TMTimerSet and TMTimerStop.
+ * TMTimerSet, TMTimerStop, TMTimerGetExpire and TMTimerDestroy (when called at
+ * runtime).
  *
  * @retval  VINF_SUCCESS on success.
Index: /trunk/src/VBox/VMM/VMMAll/TMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/TMAll.cpp	(revision 20088)
+++ /trunk/src/VBox/VMM/VMMAll/TMAll.cpp	(revision 20089)
@@ -42,4 +42,24 @@
 #ifdef IN_RING3
 # include <iprt/thread.h>
+#endif
+
+
+/*******************************************************************************
+*   Defined Constants And Macros                                               *
+*******************************************************************************/
+/** @def TMTIMER_ASSERT_CRITSECT
+ * Checks that the caller owns the critical section if one is associated with
+ * the timer. */
+#ifdef VBOX_STRICT
+# define TMTIMER_ASSERT_CRITSECT(pTimer) \
+    do { \
+        if ((pTimer)->pCritSect) \
+        { \
+            PPDMCRITSECT pCritSect = (PPDMCRITSECT)MMHyperR3ToCC((pTimer)->CTX_SUFF(pVM), (pTimer)->pCritSect); \
+            Assert(pCritSect && PDMCritSectIsOwner(pCritSect)); \
+        } \
+    } while (0)
+#else
+# define TMTIMER_ASSERT_CRITSECT(pTimer) do { } while (0)
 #endif
 
@@ -731,4 +751,5 @@
 {
     STAM_PROFILE_START(&pTimer->CTX_SUFF(pVM)->tm.s.CTXALLSUFF(StatTimerSet), a);
+    TMTIMER_ASSERT_CRITSECT(pTimer);
 
     /** @todo find the most frequently used paths and make them skip tmSchedule and tmTimerTryWithLink. */
@@ -942,4 +963,6 @@
 {
     STAM_PROFILE_START(&pTimer->CTX_SUFF(pVM)->tm.s.CTXALLSUFF(StatTimerStop), a);
+    TMTIMER_ASSERT_CRITSECT(pTimer);
+
     /** @todo see if this function needs optimizing. */
     int cRetries = 1000;
@@ -1326,4 +1349,5 @@
 VMMDECL(uint64_t) TMTimerGetExpire(PTMTIMER pTimer)
 {
+    TMTIMER_ASSERT_CRITSECT(pTimer);
     int cRetries = 1000;
     do