Fix logic botch in CJX_Object::SetAttribute(). Stray negation plus lookup based on wrong variable. Change-Id: I33c59260c3536636b0e87f14c93f23f94c106a14 Reviewed-on: https://pdfium-review.googlesource.com/c/50354 Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org>

diff --git a/fxjs/xfa/cjx_node.cpp b/fxjs/xfa/cjx_node.cpp
index 98bf510..53b1804 100644
--- a/fxjs/xfa/cjx_node.cpp
+++ b/fxjs/xfa/cjx_node.cpp

@@ -432,8 +432,12 @@
   if (params.size() != 2)
     return CJS_Result::Failure(JSMessage::kParamError);
 
+  // Note: yes, arglist is spec'd absolutely backwards from what any sane
+  // person would do, namely value first, attribute second.
   WideString attributeValue = runtime->ToWideString(params[0]);
   WideString attribute = runtime->ToWideString(params[1]);
+
+  // Pass them to our method, however, in the more usual manner.
   SetAttribute(attribute.AsStringView(), attributeValue.AsStringView(), true);
   return CJS_Result::Success();
 }

diff --git a/fxjs/xfa/cjx_object.cpp b/fxjs/xfa/cjx_object.cpp
index 710fab2..f8e1c95 100644
--- a/fxjs/xfa/cjx_object.cpp
+++ b/fxjs/xfa/cjx_object.cpp

@@ -252,8 +252,8 @@
 void CJX_Object::SetAttribute(WideStringView wsAttr,
                               WideStringView wsValue,
                               bool bNotify) {
-  Optional<XFA_ATTRIBUTEINFO> attr = XFA_GetAttributeByName(wsValue);
-  if (!attr.has_value()) {
+  Optional<XFA_ATTRIBUTEINFO> attr = XFA_GetAttributeByName(wsAttr);
+  if (attr.has_value()) {
     SetAttribute(attr.value().attribute, wsValue, bNotify);
     return;
   }

diff --git a/testing/resources/javascript/xfa_specific/xfa_node.in b/testing/resources/javascript/xfa_specific/xfa_node.in
index d4620c0..d9be2e0 100644
--- a/testing/resources/javascript/xfa_specific/xfa_node.in
+++ b/testing/resources/javascript/xfa_specific/xfa_node.in

@@ -63,9 +63,16 @@
         expect("my_doc.saveXML('pretty').length > 9000", true);  // Really long string.
         expectError("my_doc.saveXML('bogus')");
         expectError("my_doc.setAttribute()");
-        expect("my_doc.setAttribute('ns', 'something')", undefined);
-        expectError("my_doc.setElement()", undefined);
+        expectError("my_doc.setElement()");
         expect("my_doc.setElement('ns', 'something')", undefined);
+
+        // Test setting attributes in the XFA schema.
+        expect("my_doc.setAttribute('something', 'ns')", undefined);
+        expect("my_doc.getAttribute('ns')", 'something');
+
+        // Test free-form attributes outside of the XFA schema.
+        expect("my_doc.setAttribute('fake_value', 'fake_attr')", undefined);
+        expect("my_doc.getAttribute('fake_attr')", 'fake_value');
       </script>
     </event>
   </subform>

diff --git a/testing/resources/javascript/xfa_specific/xfa_node_expected.txt b/testing/resources/javascript/xfa_specific/xfa_node_expected.txt
index 154ace4..68b73a9 100644
--- a/testing/resources/javascript/xfa_specific/xfa_node_expected.txt
+++ b/testing/resources/javascript/xfa_specific/xfa_node_expected.txt

@@ -43,6 +43,9 @@
 Alert: PASS: my_doc.saveXML('pretty').length > 9000 = true
 Alert: PASS: my_doc.saveXML('bogus') threw XFAObject.saveXML: Incorrect parameter value.
 Alert: PASS: my_doc.setAttribute() threw XFAObject.setAttribute: Incorrect number of parameters passed to function.
-Alert: PASS: my_doc.setAttribute('ns', 'something') = undefined
 Alert: PASS: my_doc.setElement() threw XFAObject.setElement: Incorrect number of parameters passed to function.
 Alert: PASS: my_doc.setElement('ns', 'something') = undefined
+Alert: PASS: my_doc.setAttribute('something', 'ns') = undefined
+Alert: PASS: my_doc.getAttribute('ns') = something
+Alert: PASS: my_doc.setAttribute('fake_value', 'fake_attr') = undefined
+Alert: PASS: my_doc.getAttribute('fake_attr') = fake_value