avm2: Fix E4X [[Replace]] implementation bug

core/src/avm2/e4x.rs

@@ -488,11 +488,11 @@ impl<'gc> E4XNode<'gc> {
         }
 
         // 5. If Type(V) is XML and V.[[Class]] ∈ {"element", "comment", "processing-instruction", "text"}
-        if let Some(xml) = value.as_object().and_then(|x| x.as_xml_object()) {
-            if matches!(*xml.node().kind(), E4XNodeKind::Attribute(_)) {
-                return Ok(());
-            }
-
+        if let Some(xml) = value
+            .as_object()
+            .and_then(|x| x.as_xml_object())
+            .filter(|x| !matches!(*x.node().kind(), E4XNodeKind::Attribute(_)))
+        {
             // 5.a. If V.[[Class]] is “element” and (V is x or an ancestor of x) throw an Error exception
             if matches!(*xml.node().kind(), E4XNodeKind::Element { .. })
                 && self.ancestors().any(|x| E4XNode::ptr_eq(x, *xml.node()))

tests/tests/swfs/avm2/issue_13780/Test.as

@@ -0,0 +1,18 @@
+package {
+    import flash.display.Sprite;
+
+    public class Test extends Sprite {}
+}
+
+// Issue 13780: Replace does not work with attribute nodes.
+
+var xml = new XML('<val attr="val"/>');
+var attr = xml.@attr[0]; // Fooled by XMLList again...
+trace(attr);
+trace(attr.nodeKind());
+
+var target = new XML('<root><child1/><child2/><child3/></root>');
+
+trace(target);
+target.replace(1, attr);
+trace(target);

tests/tests/swfs/avm2/issue_13780/output.txt

@@ -0,0 +1,12 @@
+val
+attribute
+<root>
+  <child1/>
+  <child2/>
+  <child3/>
+</root>
+<root>
+  <child1/>
+  val
+  <child3/>
+</root>

tests/tests/swfs/avm2/issue_13780/test.toml

@@ -0,0 +1 @@
+num_ticks = 1