Fix GTask reference counting (#56866)

Incorrect reference counting of GTask objects meant platform channel
method calls would leave tasks alive that would leak memory and leave
unclosed references to the binary messenger.

Author: robert-ancell

shell/platform/linux/fl_basic_message_channel.cc

@@ -103,8 +103,8 @@ static void message_cb(FlBinaryMessenger* messenger,
 static void message_response_cb(GObject* object,
                                 GAsyncResult* result,
                                 gpointer user_data) {
-  GTask* task = G_TASK(user_data);
-  g_task_return_pointer(task, result, g_object_unref);
+  g_autoptr(GTask) task = G_TASK(user_data);
+  g_task_return_pointer(task, g_object_ref(result), g_object_unref);
 }
 
 // Called when the channel handler is closed.
@@ -257,8 +257,9 @@ G_MODULE_EXPORT FlValue* fl_basic_message_channel_send_finish(
   g_return_val_if_fail(FL_IS_BASIC_MESSAGE_CHANNEL(self), nullptr);
   g_return_val_if_fail(g_task_is_valid(result, self), nullptr);
 
-  g_autoptr(GTask) task = G_TASK(result);
-  GAsyncResult* r = G_ASYNC_RESULT(g_task_propagate_pointer(task, error));
+  GTask* task = G_TASK(result);
+  g_autoptr(GAsyncResult) r =
+      G_ASYNC_RESULT(g_task_propagate_pointer(task, error));
   if (r == nullptr) {
     return nullptr;
   }

shell/platform/linux/fl_binary_messenger.cc

@@ -260,8 +260,8 @@ static gboolean send_response(FlBinaryMessenger* messenger,
 static void platform_message_ready_cb(GObject* object,
                                       GAsyncResult* result,
                                       gpointer user_data) {
-  GTask* task = G_TASK(user_data);
-  g_task_return_pointer(task, result, g_object_unref);
+  g_autoptr(GTask) task = G_TASK(user_data);
+  g_task_return_pointer(task, g_object_ref(result), g_object_unref);
 }
 
 static void send_on_channel(FlBinaryMessenger* messenger,
@@ -290,8 +290,9 @@ static GBytes* send_on_channel_finish(FlBinaryMessenger* messenger,
   FlBinaryMessengerImpl* self = FL_BINARY_MESSENGER_IMPL(messenger);
   g_return_val_if_fail(g_task_is_valid(result, self), FALSE);
 
-  g_autoptr(GTask) task = G_TASK(result);
-  GAsyncResult* r = G_ASYNC_RESULT(g_task_propagate_pointer(task, error));
+  GTask* task = G_TASK(result);
+  g_autoptr(GAsyncResult) r =
+      G_ASYNC_RESULT(g_task_propagate_pointer(task, error));
   if (r == nullptr) {
     return nullptr;
   }

shell/platform/linux/fl_method_channel.cc

@@ -63,8 +63,8 @@ static void message_cb(FlBinaryMessenger* messenger,
 static void message_response_cb(GObject* object,
                                 GAsyncResult* result,
                                 gpointer user_data) {
-  GTask* task = G_TASK(user_data);
-  g_task_return_pointer(task, result, g_object_unref);
+  g_autoptr(GTask) task = G_TASK(user_data);
+  g_task_return_pointer(task, g_object_ref(result), g_object_unref);
 }
 
 // Called when the channel handler is closed.
@@ -196,8 +196,9 @@ G_MODULE_EXPORT FlMethodResponse* fl_method_channel_invoke_method_finish(
   g_return_val_if_fail(FL_IS_METHOD_CHANNEL(self), nullptr);
   g_return_val_if_fail(g_task_is_valid(result, self), nullptr);
 
-  g_autoptr(GTask) task = G_TASK(result);
-  GAsyncResult* r = G_ASYNC_RESULT(g_task_propagate_pointer(task, error));
+  GTask* task = G_TASK(result);
+  g_autoptr(GAsyncResult) r =
+      G_ASYNC_RESULT(g_task_propagate_pointer(task, error));
   if (r == nullptr) {
     return nullptr;
   }