Index: /trunk/src/VBox/Main/webservice/vboxweb.cpp
===================================================================
--- /trunk/src/VBox/Main/webservice/vboxweb.cpp	(revision 29813)
+++ /trunk/src/VBox/Main/webservice/vboxweb.cpp	(revision 29814)
@@ -1472,4 +1472,6 @@
 
     do {
+        util::AutoReadLock lock(g_pSessionsLockHandle COMMA_LOCKVAL_SRC_POS);
+
         ManagedObjectRef *pRef;
         if (!ManagedObjectRef::findRefFromId(req->_USCOREthis, &pRef, false))
@@ -1503,4 +1505,6 @@
 
     do {
+        util::AutoReadLock lock(g_pSessionsLockHandle COMMA_LOCKVAL_SRC_POS);
+
         ManagedObjectRef *pRef;
         if ((rc = ManagedObjectRef::findRefFromId(req->_USCOREthis, &pRef, false)))
@@ -1556,8 +1560,4 @@
  * client to clean up itself.
  *
- * Preconditions: Caller must have locked g_mutexSessions.
- * Since this gets called from main() like other SOAP method
- * implementations, this is ensured.
- *
  * @param
  * @param vbox__IWebsessionManager_USCORElogon
@@ -1585,6 +1585,6 @@
                                      req->password.c_str())))
         {
-            // in the new session, create a managed object reference (moref) for the
-            // global VirtualBox object; this encodes the session ID in the moref so
+            // in the new session, create a managed object reference (MOR) for the
+            // global VirtualBox object; this encodes the session ID in the MOR so
             // that it will be implicitly be included in all future requests of this
             // webservice client
@@ -1604,8 +1604,4 @@
  * Returns the ISession object that was created for the webservice client
  * on logon.
- *
- * Preconditions: Caller must have locked g_mutexSessions.
- * Since this gets called from main() like other SOAP method
- * implementations, this is ensured.
  */
 int __vbox__IWebsessionManager_USCOREgetSessionObject(
@@ -1637,8 +1633,4 @@
  * hard-coded implementation for IWebsessionManager::logoff.
  *
- * Preconditions: Caller must have locked g_mutexSessions.
- * Since this gets called from main() like other SOAP method
- * implementations, this is ensured.
- *
  * @param
  * @param vbox__IWebsessionManager_USCORElogon