Assertion failure in QtWebChannel SignalHandler code

I've been trying to track down an assertion deep inside the QtWebEngine code for a while.  It appears to be triggered by my use of `webChannel.registeredObjects: [eventBridgeWrapper]` inside a WebEngineView, but only in certain cases.  The assertion itself is inside `SignalHandler<Receiver>::remove`, which complains that an object provided for removal is not actually in the connections.  

I believe this is a bug in the `QMetaObjectPublisher` class, in `QMetaObjectPublisher::objectDestroyed`.  The `QMetaObjectPublisher::registerObject` method always populates the `registeredObjectIds` and `registeredObjects` maps.  But it the `propertyUpdatesInitialized` member is not true, then it does not populate the `signalHandler` or `signalToPropertyMap` members.  The `QMetaObjectPublisher::objectDestroyed` method doesn't take this case into account.  It attempts to remove an object from the signalHandler and signalToPropertyMap members, regardless of whether `propertyUpdatesInitialized` is true or false, thus triggering the assert.  

I'm trying to create a small reproducible version of this bug, but I'm having trouble isolating the exact QML / C++ interaction responsible.  For now I've attached a screenshot of the full call stack.

I'm not sure if the issue causes any problems beyond the assert, though I am trying to track down a rare crash deep inside our QML rendering, so it's a point of concern.