diff --git a/kernel/rtlil.cc b/kernel/rtlil.cc
index dc368ead5..6996a02c4 100644
--- a/kernel/rtlil.cc
+++ b/kernel/rtlil.cc
@@ -597,6 +597,7 @@ void RTLIL::Design::remove(RTLIL::Module *module)
 	}
 
 	log_assert(modules_.at(module->name) == module);
+	log_assert(refcount_modules_ == 0);
 	modules_.erase(module->name);
 	delete module;
 }
diff --git a/passes/cmds/design.cc b/passes/cmds/design.cc
index 4612760cc..8861182aa 100644
--- a/passes/cmds/design.cc
+++ b/passes/cmds/design.cc
@@ -340,7 +340,7 @@ struct DesignPass : public Pass {
 
 		if (reset_mode || !load_name.empty() || push_mode || pop_mode)
 		{
-			for (auto mod : design->modules())
+			for (auto mod : design->modules().to_vector())
 				design->remove(mod);
 
 			design->selection_stack.clear();