Fix use-after-free in AsyncEventBeat (#43618)

Summary:
Pull Request resolved: #43618

Both common and Android implementations of AsyncEventBeat use weak_ptrs
to determine if the object is still valid before invoking the callback.
Move the write to `isBeatCallbackScheduled_` down so it's protected by
that same check.

Changelog: [Internal]

Reviewed By: javache, NickGerleman

Differential Revision: D55226529

fbshipit-source-id: 9e2a34369346d11dcea69d120dfa5935320f9ba1

packages/react-native/ReactAndroid/src/main/jni/react/fabric/AsyncEventBeat.cpp

@@ -38,12 +38,12 @@ void AsyncEventBeat::tick() const {
   isBeatCallbackScheduled_ = true;
 
   runtimeExecutor_([this, ownerBox = ownerBox_](jsi::Runtime& runtime) {
-    isBeatCallbackScheduled_ = false;
     auto owner = ownerBox->owner.lock();
     if (!owner) {
       return;
     }
 
+    isBeatCallbackScheduled_ = false;
     if (beatCallback_) {
       beatCallback_(runtime);
     }

packages/react-native/ReactCommon/react/renderer/scheduler/AsynchronousEventBeat.cpp

@@ -43,13 +43,12 @@ void AsynchronousEventBeat::induce() const {
   isBeatCallbackScheduled_ = true;
 
   runtimeExecutor_([this, weakOwner](jsi::Runtime& runtime) {
-    isBeatCallbackScheduled_ = false;
-
     auto owner = weakOwner.lock();
     if (!owner) {
       return;
     }
 
+    isBeatCallbackScheduled_ = false;
     if (beatCallback_) {
       beatCallback_(runtime);
     }