Fix logic error in CJX_InstanceManager::count()

Calling the Setter when the Getter was intended results in a segv
when accessing the empty return value.

Bug: 353450
Change-Id: If3d35de1c5e2a24d11690fd323253f1103ee9ab5
Reviewed-on: https://pdfium-review.googlesource.com/36431
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

fxjs/xfa/cjx_instancemanager.cpp

diff --git a/fxjs/xfa/cjx_instancemanager.cpp b/fxjs/xfa/cjx_instancemanager.cpp
index d9471cd..f44ccba 100644
--- a/fxjs/xfa/cjx_instancemanager.cpp
+++ b/fxjs/xfa/cjx_instancemanager.cpp
@@ -320,8 +320,8 @@
                                 bool bSetting,
                                 XFA_Attribute eAttribute) {
   if (bSetting) {
-    pValue->SetInteger(GetXFANode()->GetCount());
+    SetInstances(pValue->ToInteger());
     return;
   }
-  SetInstances(pValue->ToInteger());
+  pValue->SetInteger(GetXFANode()->GetCount());
 }