From 06959df890dea3d7cc1e70d9c1ea10c6469f045f Mon Sep 17 00:00:00 2001
From: aiongg <aiongtaigi@gmail.com>
Date: Sat, 24 Oct 2026 08:15:46 +0000
Subject: [PATCH] Integration: execMenuItem requests go through the request cap
 (#3580)

A script looping on app.execMenuItem could queue unlimited requests; they now follow the same count and byte limits as other requests.
---
 crates/js/src/lib.rs   | 2 +-
 crates/js/src/tests.rs | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index 7f463a48b..4db899c1c 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -704,7 +704,7 @@ pub(crate) fn menu_item(name: &str) -> Option<Request> {
 fn exec_menu_item(_: &JsValue, args: &[JsValue], ctx: &mut Context) -> JsResult<JsValue> {
     let item = text(&arg(args, 0), ctx)?;
     if let Some(r) = menu_item(&item) {
-        host(ctx)?.borrow_mut().requests.push(r);
+        host(ctx)?.borrow_mut().request(r);
     }
     Ok(JsValue::undefined())
 }
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index 06d699bcb..3d3c4ab52 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -254,6 +254,13 @@ fn kept_bytes(o: &Outcome) -> usize {
     o.console.iter().chain(&o.alerts).map(String::len).sum::<usize>() + o.requests.iter().map(req).sum::<usize>()
 }
 
+#[test]
+fn exec_menu_item_requests_are_capped_like_other_requests() {
+    let o = go("for (var i = 0; i < 12000; i++) app.execMenuItem('Print');", &Event::field("Mouse Up", "agree", ""));
+    assert_eq!(o.error, None);
+    assert_eq!(o.requests.len(), crate::xfa::MAX_EFFECTS);
+}
+
 #[test]
 fn console_alerts_and_requests_are_capped_in_count_and_bytes() {
     let o = go(