Index: generic/src/mm/as.c
===================================================================
--- generic/src/mm/as.c	(revision 152b2b0ca223d7a95abf0fbd5e89c977c114a9ce)
+++ generic/src/mm/as.c	(revision d0c59014273d37ae8d8218bc43b145fd27e12bb6)
@@ -137,5 +137,5 @@
 {
 	ipl_t ipl;
-	bool cond;
+	link_t *cur;
 
 	ASSERT(as->refcount == 0);
@@ -157,13 +157,13 @@
 	 * Destroy address space areas of the address space.
 	 */	
-	for (cond = true; cond; ) {
+	for (cur = as->as_area_btree.leaf_head.next; cur != &as->as_area_btree.leaf_head; cur = cur->next) {
 		btree_node_t *node;
+		int i;
 		
-		ASSERT(!list_empty(&as->as_area_btree.leaf_head));
-		node = list_get_instance(&as->as_area_btree.leaf_head.next, btree_node_t, leaf_link);
-		if ((cond = node->keys))
-			as_area_destroy(as, node->key[0]);
-	}
-	
+		node = list_get_instance(cur, btree_node_t, leaf_link);
+		for (i = 0; i < node->keys; i++)
+			as_area_destroy(as, node->key[i]);
+	}
+
 	btree_destroy(&as->as_area_btree);
 	page_table_destroy(as->page_table);
@@ -411,6 +411,6 @@
 	as_area_t *area;
 	__address base;
+	link_t *cur;
 	ipl_t ipl;
-	bool cond;
 
 	ipl = interrupts_disable();
@@ -433,29 +433,24 @@
 	/*
 	 * Visit only the pages mapped by used_space B+tree.
-	 * Note that we must be very careful when walking the tree
-	 * leaf list and removing used space as the leaf list changes
-	 * unpredictibly after each remove. The solution is to actually
-	 * not walk the tree at all, but to remove items from the head
-	 * of the leaf list until there are some keys left.
-	 */
-	for (cond = true; cond;) {
+	 */
+	for (cur = area->used_space.leaf_head.next; cur != &area->used_space.leaf_head; cur = cur->next) {
 		btree_node_t *node;
+		int i;
 		
-		ASSERT(!list_empty(&area->used_space.leaf_head));
-		node = list_get_instance(area->used_space.leaf_head.next, btree_node_t, leaf_link);
-		if ((cond = (bool) node->keys)) {
-			__address b = node->key[0];
-			count_t i;
+		node = list_get_instance(cur, btree_node_t, leaf_link);
+		for (i = 0; i < node->keys; i++) {
+			__address b = node->key[i];
+			count_t j;
 			pte_t *pte;
 			
-			for (i = 0; i < (count_t) node->value[0]; i++) {
+			for (j = 0; j < (count_t) node->value[i]; j++) {
 				page_table_lock(as, false);
-				pte = page_mapping_find(as, b + i*PAGE_SIZE);
+				pte = page_mapping_find(as, b + j*PAGE_SIZE);
 				ASSERT(pte && PTE_VALID(pte) && PTE_PRESENT(pte));
 				if (area->backend && area->backend->frame_free) {
 					area->backend->frame_free(area,
-						b + i*PAGE_SIZE, PTE_GET_FRAME(pte));
+						b + j*PAGE_SIZE, PTE_GET_FRAME(pte));
 				}
-				page_mapping_remove(as, b + i*PAGE_SIZE);
+				page_mapping_remove(as, b + j*PAGE_SIZE);
 				page_table_unlock(as, false);
 			}
@@ -1474,5 +1469,5 @@
 	if (--sh_info->refcount == 0) {
 		dealloc = true;
-		bool cond;
+		link_t *cur;
 		
 		/*
@@ -1480,12 +1475,11 @@
 		 * reference from all frames found there.
 		 */
-		for (cond = true; cond;) {
+		for (cur = sh_info->pagemap.leaf_head.next; cur != &sh_info->pagemap.leaf_head; cur = cur->next) {
 			btree_node_t *node;
+			int i;
 			
-			ASSERT(!list_empty(&sh_info->pagemap.leaf_head));
-			node = list_get_instance(sh_info->pagemap.leaf_head.next, btree_node_t, leaf_link);
-			if ((cond = node->keys)) {
-				frame_free(ADDR2PFN((__address) node->value[0]));
-			}
+			node = list_get_instance(cur, btree_node_t, leaf_link);
+			for (i = 0; i < node->keys; i++) 
+				frame_free(ADDR2PFN((__address) node->value[i]));
 		}