Index: /trunk/src/VBox/VMM/VMMR0/GMMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/GMMR0.cpp	(revision 29509)
+++ /trunk/src/VBox/VMM/VMMR0/GMMR0.cpp	(revision 29510)
@@ -3776,4 +3776,5 @@
             if (pGlobalRegion->paHCPhysPageID[i] == NIL_GMM_PAGEID)
             {
+new_shared_page:
                 /* Easy case: just change the internal page type. */
                 PGMMPAGE pPage = gmmR0GetPage(pGMM, paPageDesc[i].uHCPhysPageId);
@@ -3809,5 +3810,12 @@
                     goto end;
                 }
-                Assert(pPage->Common.u2State == GMM_PAGE_STATE_SHARED);
+                if (pPage->Common.u2State != GMM_PAGE_STATE_SHARED)
+                {
+                    /* Page was freed at some point; invalidate this entry. */
+                    /** todo this isn't really bullet proof. */
+                    Log(("Old shared page was freed -> create a new one\n"));
+                    pGlobalRegion->paHCPhysPageID[i] = NIL_GMM_PAGEID;
+                    goto new_shared_page; /* ugly goto */
+                }
 
                 Log(("Replace existing page guest %RGp host %RHp -> %RHp\n", paPageDesc[i].GCPhys, paPageDesc[i].HCPhys, pPage->Shared.pfn << PAGE_SHIFT));