The GetReferenceTypeSubtypes function inside ViewServiceSet/Browse/get_references.js attempts to protect against a stack-overflow by incrementing a level variable each time the function is recursively called, and prematurely ends the test if the level exceeds 12.

This has been implemented incorrectly as line 280 calls ++level while iterating through sibling references of a node. So if the function browses a node that contains N references, and each of those references has zero subtypes, after each of the references has been iterated through the level variable will now be set to N. This is wrong - because the call stack is still on the first level.

Instead of ++level, I believe the code should be level + 1 when calling the function recursively. This will mean the level will increase when building up the callstack, and then decrease when frames are popped from the stack.