avm2: Implement a few avmplus XML edge cases

core/src/avm2/globals/xml.rs

@@ -829,12 +829,24 @@ pub fn replace<'gc>(
     // 2. If Type(value) ∉ {XML, XMLList}, let c = ToString(value)
     // 3. Else let c be the result of calling the [[DeepCopy]] method of value
     let value = if let Some(xml) = value.as_object().and_then(|x| x.as_xml_object()) {
-        let node = xml.node();
-        XmlObject::new(node.deep_copy(activation.context.gc_context), activation).into()
+        xml.deep_copy(activation).into()
     } else if let Some(list) = value.as_object().and_then(|x| x.as_xml_list_object()) {
         list.deep_copy(activation).into()
     } else {
-        value
+        // NOTE: Depends on root swf version.
+        // See https://github.com/adobe/avmplus/blob/858d034a3bd3a54d9b70909386435cf4aec81d21/core/XMLObject.cpp#L1540
+        if activation.context.swf.version() <= 9 {
+            // SWF version 9 edge case, call XML constructor.
+            // https://github.com/adobe/avmplus/blob/858d034a3bd3a54d9b70909386435cf4aec81d21/core/XMLObject.cpp#L2241-L2242
+            activation
+                .avm2()
+                .classes()
+                .xml
+                .construct(activation, &[value])?
+                .into()
+        } else {
+            value
+        }
     };
 
     // 4. If ToString(ToUint32(P)) == P

core/src/avm2/object/xml_list_object.rs

@@ -717,6 +717,18 @@ impl<'gc> TObject<'gc> for XmlListObject<'gc> {
                                 E4XNode::text(activation.gc(), "".into(), r)
                             }
                             None => E4XNode::text(activation.gc(), "".into(), r),
+                            // NOTE: avmplus edge case.
+                            //       See https://github.com/adobe/avmplus/blob/858d034a3bd3a54d9b70909386435cf4aec81d21/core/XMLListObject.cpp#L297-L300
+                            _ if value
+                                .as_object()
+                                .and_then(|x| x.as_xml_object())
+                                .map_or(false, |x| {
+                                    x.node().is_text() || x.node().is_attribute()
+                                }) =>
+                            {
+                                E4XNode::text(activation.gc(), "".into(), r)
+                            }
+
                             // 2.c.vi. Else let y.[[Class]] = "element"
                             Some(property) => E4XNode::element(
                                 activation.gc(),

tests/tests/swfs/from_avmplus/e4x/XML/e13_4_4_3/v9/test.toml

@@ -1,2 +1 @@
 num_ticks = 1
-known_failure = true

tests/tests/swfs/from_avmplus/e4x/XML/e13_4_4_32/v9/test.toml

@@ -1,2 +1 @@
 num_ticks = 1
-known_failure = true