Correctly link transports to implicitly wrapped objects

When an object is wrapped as consequence of a property update or signal
emission, wrapResult() assigns it the parent object's list of transports.
It didn't, however, establish the reverse relation, i.e from transport
to object. This resulted in dangling pointers after client disconnects
and subsequent crashes.
This patch fixes the bug.

Change-Id: I5d20269c453902bf2883dfcab1f3ab5d0757c2cd
Reviewed-by: Frederik Gladhorn <frederik.gladhorn@qt.io>

1 files changed, 5 insertions, 1 deletions

diff --git a/src/webchannel/qmetaobjectpublisher.cpp b/src/webchannel/qmetaobjectpublisher.cpp
index 102cbda..e23921d 100644
--- a/src/webchannel/qmetaobjectpublisher.cpp
+++ b/src/webchannel/qmetaobjectpublisher.cpp
@@ -739,15 +739,19 @@ QJsonValue QMetaObjectPublisher::wrapResult(const QVariant &result, QWebChannelA
             ObjectInfo oi(object);
             if (transport) {
                 oi.transports.append(transport);
+                transportedWrappedObjects.insert(transport, id);
             } else {
                 // use the transports from the parent object
                 oi.transports = wrappedObjects.value(parentObjectId).transports;
                 // or fallback to all transports if the parent is not wrapped
                 if (oi.transports.isEmpty())
                     oi.transports = webChannel->d_func()->transports;
+
+                for (auto transport : qAsConst(oi.transports)) {
+                    transportedWrappedObjects.insert(transport, id);
+                }
             }
             wrappedObjects.insert(id, oi);
-            transportedWrappedObjects.insert(transport, id);
 
             initializePropertyUpdates(object, classInfo);
         } else if (wrappedObjects.contains(id)) {