Index: /trunk/src/VBox/VMM/PGMPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGMPhys.cpp	(revision 22697)
+++ /trunk/src/VBox/VMM/PGMPhys.cpp	(revision 22698)
@@ -422,4 +422,6 @@
     AssertPtr(pLock);
 
+    Assert(VM_IS_EMT(pVM) || !PGMIsLockOwner(pVM));
+
     int rc = pgmLock(pVM);
     AssertRCReturn(rc, rc);
@@ -436,15 +438,4 @@
             rc = VERR_PGM_PHYS_PAGE_RESERVED;
         else
-#if 0
-        if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
-        {
-            /* We *must* flush any corresponding pgm pool page here, otherwise we'll
-             * not be informed about writes and keep bogus gst->shw mappings around.
-             */
-            PGMPoolFlushPage(pVM, GCPhys);
-            Assert(!PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage));
-        }
-        else
-#endif
         {
             /*
@@ -453,5 +444,6 @@
              * This has to be done on an EMT.
              */
-            if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
+            if (    PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage)
+                ||  RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
             {
                 pgmUnlock(pVM);
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 22697)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 22698)
@@ -4711,4 +4711,6 @@
     PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
 
+    VM_ASSERT_EMT(pVM);
+
     /*
      * Look up the GCPhys in the hash.