If the callback passed to forEach tries to remove the element it was passed, there's a use-after-free of the entry pointer in forEach. Change-Id: Ia364b4775c9c55780b23f683b30cbff511b7f944 Signed-off-by: Dima Zavin <dima@android.com>