Fix a crasher due to recursion in CXFA_WidgetAcc::ExecuteScript()

xfa/src/fxfa/src/app/xfa_ffwidgetacc.cpp

Index: xfa/src/fxfa/src/app/xfa_ffwidgetacc.cpp
diff --git a/xfa/src/fxfa/src/app/xfa_ffwidgetacc.cpp b/xfa/src/fxfa/src/app/xfa_ffwidgetacc.cpp
index 34d87f44c18415e125a5c44bfd1bef441dfe1ab1..4123e5d3d1f60ad0264388e590560d43097a1b64 100644
--- a/xfa/src/fxfa/src/app/xfa_ffwidgetacc.cpp
+++ b/xfa/src/fxfa/src/app/xfa_ffwidgetacc.cpp
@@ -175,7 +175,10 @@ class CXFA_ImageEditData : public CXFA_FieldLayoutData {
   int32_t m_iImageYDpi;
 };
 CXFA_WidgetAcc::CXFA_WidgetAcc(CXFA_FFDocView* pDocView, CXFA_Node* pNode)
-    : CXFA_WidgetData(pNode), m_pDocView(pDocView), m_pLayoutData(NULL) {}
+    : CXFA_WidgetData(pNode),
+      m_pDocView(pDocView),
+      m_pLayoutData(NULL),
+      m_nRecurRef(0) {}
 CXFA_WidgetAcc::~CXFA_WidgetAcc() {
   if (m_pLayoutData) {
     m_pLayoutData->Release();
@@ -630,6 +633,9 @@ int32_t CXFA_WidgetAcc::ProcessValidate(int32_t iFlags) {
 int32_t CXFA_WidgetAcc::ExecuteScript(CXFA_Script script,
                                       CXFA_EventParam* pEventParam,
                                       FXJSE_HVALUE* pRetValue) {
+  static const uint32_t MAX_EXECUTE_RECURSION = 2;

[jun_fang, 2015/11/30 09:19:30]

We got the maximum recursion by testing other companies' XFA products. 

+  if (m_nRecurRef > MAX_EXECUTE_RECURSION)
+    return XFA_EVENTERROR_Sucess;
   FXSYS_assert(pEventParam);
   if (!script) {
     return XFA_EVENTERROR_NotExist;
@@ -656,9 +662,10 @@ int32_t CXFA_WidgetAcc::ExecuteScript(CXFA_Script script,
     pContext->SetNodesOfRunScript(&refNodes);
   }
   FXJSE_HVALUE hRetValue = FXJSE_Value_Create(pContext->GetRuntime());
-  FX_BOOL bRet = FALSE;
-  bRet = pContext->RunScript((XFA_SCRIPTLANGTYPE)eScriptType, wsExpression,
-                             hRetValue, m_pNode);
+  ++m_nRecurRef;
+  FX_BOOL bRet = pContext->RunScript((XFA_SCRIPTLANGTYPE)eScriptType,
+                                     wsExpression, hRetValue, m_pNode);
+  --m_nRecurRef;
   int32_t iRet = XFA_EVENTERROR_Error;
   if (bRet) {
     iRet = XFA_EVENTERROR_Sucess;