Okay, so it's having an issue with this part: 

if(e.origin != document.referrer.replace(/\/$/, "")) {

Where it is attempting to confirm the button and the iFrame are on the same source.  This is just there to try to boost security.

If this is entirely an internal form, that won't be public - you would probably be okay removing that particular if/else statement, and just running the code that is currently inside the else part of the statement.

But if it is public, we want to confirm what the issue is.

Can you add these two lines before that if statement? 

console.log(e.origin);
console.log(document.referrer.replace(/\/$/, ""));

So we can see why that isn't working?

Here's what I got:

Also, I dont know why it goes through the tests over and over - I only clicked the button twice.

In my environment, which is on prem, both of these return the same value: 

console.log(e.origin);
console.log(document.referrer.replace(/\/$/, ""));

But in your case, probably a difference with LFCloud, the first one is returning the URL and the second one is returning nothing.  So it's not catching that they match, and therefore isn't progressing into the "else" part of the code.

As I mentioned before, that if statement is trying to confirm the message from the button press and the listener in the iFrame are both on the same page - trying to prevent a malicious message from outside being injected.  It might be okay to remove that check - especially if this won't be available publically.  Even if it is public, you are still limiting it to just that one particular message via the remaining if statement, and the actions it is taking to populate the word ready into the form are pretty limited.  So that could probably be removed - but that's a decision you have to make.  If you are okay with that, you could comment out the other sections, and it would look something like this: 

//Set adjustable parameters for the form.
var timerLength = 75;         //Length is seconds given to complete the test.
var timerFieldID = 3;         //This is the q-id value for the (hidden) field that will track the remaining time.
var startedFlagID = 130;        //This is the q-id value for the (hidden) field that tracks whether or not the test has been started.
var startButtonFieldID = 129;   //This is the q-id value for the custom HTML element that contains the button to start the test.

//Listen for messages.  This allows this sandboxed
//iframe to receive messages from the form,
//so that custom buttons can be used to
//trigger this code.
console.log('test 1');
window.addEventListener('message', function (e) {
  //Verify message source is the parent page.
  //console.log('test 2');
  //console.log(e.origin);
  //console.log(document.referrer.replace(/\/$/, ""));
  //if(e.origin != document.referrer.replace(/\/$/, "")) {
    //console.log('test 3');
    //return;
  //}
  //else {
    //Handle the specific messages.
    console.log('test 4');
    if(e.data.toString() == 'click-start-timer-button') {
      console.log('test 5');
      LFForm.setFieldValues({fieldId: timerFieldID}, timerLength);
      LFForm.setFieldValues({fieldId: startedFlagID}, 'Ready');
      LFForm.changeFieldSettings({fieldId: startButtonFieldID},{HTMLContent: ''});
    }
  //}
});

Because the if block is commented out, and the start and end of the else block are commented out, the code that was previously not running within the else block, will just run automatically as the only code.  So you should see it say test 1 when the form loads, and then when the button is clicked, it should say test 4, test 5, populate the word Ready into that field, and hide the button.

Sadly, I have no idea why you were seeing it run those code blocks multiple times like that - it's like it is sending that message over and over again, or creating the listener multiple times, and it should not be doing either of those.  If it is still doing that after the code is changed (if you see it saying test 4 and test 5 over and over again), we might need to investigate that.  It is not a behavior I saw in my environment.  Though, in my environment, the else block ran and the button was consequently hidden, but in your environment that was not happening, so maybe that was the reason, and you'll no longer see that happen with this code change...

EDITED TO STRIKE OUT THAT LAST PARAGRAPH - SEE FOLLOW-UP REPLY FOR EXPLANATION.

EDITED TO STRIKE OUT THIS TEXT - SEE THE NEXT REPLY.

If you want to try to narrow down what is being triggered multiple times, the button click or the listener - you could try this...

On the button itself, where it starts with this:

<button onclick="document.getElementById('LFForm_sandbox')...

Insert a console.log command into the onclick event, which should post a message every time the button is clicked:

<button onclick="console.log('clicked!'); document.getElementById('LFForm_sandbox')...

Basically, if you only see that "clicked!" message once, but you see the "test..." messages too many times, we know that the click is only happening once, but the listener is happening lots of times.  But if you see that "clicked!" message a lot of times, we know the click event on the button is happening too many times.  That doesn't solve the issue, but at least helps us know what to research.

Ugh - this should have been obvious to me in the beginning...

Forms is likely also using its own message events, so of course the listener is triggering more times, it's not just your button click, but all the other events happening.  I didn't dive as deep with the console.log tests as you did, so I didn't see it.  But I just tested now, and I see at least 5 other message events being triggered when I load the form, that have nothing to do with the button click.

That's not a problem, and that's why our code is not only triggering at the message event, but checking for the specific message ("click-start-timer-button").  The listener will trigger from any message, we only care about ours.

Sorry - I feel sheepish about that.

Here's cleaned up version of the code from the earlier reply.

This doesn't have any of the console.log testing, and doesn't do the origin versus referred check.  It only verify that the message is the expected one and then proceeds if it is.  

//Set adjustable parameters for the form.
var timerLength = 75;         //Length is seconds given to complete the test.
var timerFieldID = 3;         //This is the q-id value for the (hidden) field that will track the remaining time.
var startedFlagID = 130;        //This is the q-id value for the (hidden) field that tracks whether or not the test has been started.
var startButtonFieldID = 129;   //This is the q-id value for the custom HTML element that contains the button to start the test.

//Listen for messages.  This allows this sandboxed
//iframe to receive messages from the form,
//so that custom buttons can be used to
//trigger this code.
window.addEventListener('message', function (e) {
  //Handle the specific messages.
  if(e.data.toString() == 'click-start-timer-button') {
    LFForm.setFieldValues({fieldId: timerFieldID}, timerLength);
    LFForm.setFieldValues({fieldId: startedFlagID}, 'Ready');
    LFForm.changeFieldSettings({fieldId: startButtonFieldID},{HTMLContent: ''});
  }
});

That looks like it's not finding the iFrame where the Javascript is running.  :-(

If you go into the Inspect Elements function of the browser on your form, we're looking for an iFrame element that looks something like this (this is the beginning and end of it, there's a lot of other stuff in the middle).

Notice at the end there, it includes the id of LFForm_sandbox?

What the button is doing is trying to send a message to that element, the iFrame with the LFForm_sandbox ID.  The error you showed in your last reply makes it look like it isn't finding that LFForm_sandbox element.

I'm wondering if this is different in LFCloud - either that iFrame is structured completely differently, or it has a different ID or something... 

Unfortunately, I'm just speculating here - as I don't have access to a LFCloud environment to test/compare.

This is what's going on in the page. It does look like it's making that LFForm_sandbox ID. Though it is including html quotes: