Hi Jaeyong,
Avl_node_base::remove function removes itself from the Avl_tree and leaves the _parent and _child[] variables as they are. Since someone could try to remove the same Avl_node_base twice by mistake, it results in the crash of Avl_tree datastructure. So, how about setting _parent and _child[] to NULL at Avl_node_base::remove and, at the entry of the remove function, if someone tries to remove twice, we could warn him.
thank you for this sensible suggestion. I have just added it to the issue tracker:
https://github.com/genodelabs/genode/issues/597
Best regards Norman