Fixed the stack switching.  
It isn't possible to access memory between changing the stack and setting the cr3 register. 
A page fault needs a valid kmode stack which is possible not available.

Modified: trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S

--- trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S	2005-05-08 15:57:51 UTC (rev 15128)
+++ trunk/reactos/ntoskrnl/ke/i386/ctxswitch.S	2005-05-08 15:59:07 UTC (rev 15129)
@@ -152,26 +152,27 @@

     /* Save the stack pointer in this processors TSS */
     mov ebp, [ebx+KPCR_TSS]
     push ss:[ebp+KTSS_ESP0]

+    
+    /* Check if address space switch is needed */
+    mov eax, [esi+KTHREAD_APCSTATE_PROCESS]
+    cmp eax, [edi+KTHREAD_APCSTATE_PROCESS]
+    mov eax, [eax+KPROCESS_DIRECTORY_TABLE_BASE]

 
     /* Switch stacks */
     mov [edi+KTHREAD_KERNEL_STACK], esp
     mov esp, [esi+KTHREAD_KERNEL_STACK]

+    
+    jz	NoAddressSpaceSwitch
+    
+    /* Switch address space */
+    mov cr3, eax

-    /* 
-     * Sadly, ROS memory management is screwed up, so 
-     * we must change the address space here.
-     */
-    mov eax, [esi+KTHREAD_APCSTATE_PROCESS]
-    mov eax, [eax+KPROCESS_DIRECTORY_TABLE_BASE]
-    mov cr3, eax
-    

+NoAddressSpaceSwitch:   
+   

     /* Stack is OK, safe to enable interrupts now */
     sti 
 

-    /* Check if address space switch is needed */
-    mov eax, [edi+KTHREAD_APCSTATE_PROCESS]
-    cmp eax, [esi+KTHREAD_APCSTATE_PROCESS]
-    

+    /* Check if address space switch is needed (the result from above is valid) */

     /* If they match, then use the fast-path and skip all this */
     jz SameProcess