Update 1 (8/26/19 @ 12:10 PM EST): We have confirmation about the codenames for the Pixel 4 and Pixel 4 XL. More details below.
We are still some time away from officially meeting the Google Pixel 4 and the Google Pixel 4 XL, but leak season is already underway. The Pixel 4 was recently name-dropped in the AOSP source code, indicating that the phone is in existence and possibly already in the hands of a few developers. Now, codenames of a total of three unreleased Google devices were spotted in the AOSP Gerrit.
As reported by 9to5Google, the commit by Google attempted to fix certain labeling issues with Android's SELinux policy. Within the comments of that commit, a developer from Google mentioned a list of files which in turn contain the codename of these devices in the filename/path.
device/google/bonito-sepolicy/vendor/qcom/common/genfs_contexts:67device/google/coral-sepolicy/vendor/qcom/common/genfs_contexts:17device/google/crosshatch-sepolicy/vendor/qcom/common/genfs_contexts:72device/google/marlin/sepolicy/genfs_contexts:17device/google/needlefish-sepolicy/vendor/qcom/common/genfs_contexts:16device/google/wahoo/sepolicy/vendor/genfs_contexts:49
Of these six devices, four of them are already known: Marlin (Pixel XL), Wahoo (combined codename for Pixel 2 and Pixel 2 XL), Crosshatch (Pixel 3 XL), and Bonito (Pixel 3a XL). This leaves out "Coral" and "Needlefish" as two unknown devices mentioned alongside the Pixels. As it turns out, the latest beta version of the Google app plainly mentions the codename "Coral" in relation to the Pixel 4 and additionally mentions "Flame" as the codename for the Pixel 4 XL.
This still leaves out "Needlefish" as a mystery device. It is speculated that "Needlefish" may be its own standalone device running some form of Android. Details are still sparse on this device, but we wouldn't be too surprised if the device leaks completely well before its launch.
Data from benchmarks suggest that the Google Pixel 4 "Coral" will come with as much as 6GB of RAM, and of course, the latest Qualcomm Snapdragon 855 SoC. Since benchmark data can be manipulated rather easily, it is advisable to wait for more credible data to make further assumptions.
Update 1: Codenames Confirmed
After a bit of digging, we found evidence directly linking the Google Pixel 4 2019 with the codename "flame" and the Google Pixel 4 XL 2019's with the codename "coral." We haven't found anything regarding "needlefish," though.