The following code is flagged as dead (since it's *replacing* rather than updating the existing Object):
https://github.com/mozilla/pdf.js/blob/4483cba72410027acf46630ebf252ae529704476/src/core/xfa/template.js#L2336-L2339
according to the alert in https://github.com/mozilla/pdf.js/security/code-scanning/103?query=ref%3Arefs%2Fheads%2Fmaster

Looking at the surrounding code, I can see a couple of possibilities here:
 1. This is indeed just dead code, which should be removed.
 2. The code should be moved up, and placed just *above* the previous block instead.
 3. There should be other, more invasive, changes made to this code...

/cc @calixteman Which solution is correct here?
Assuming it's either option 1 or 2, I can submit a patch to fix this.
if (this.margin) {
      marginH = this.margin.leftInset + this.margin.rightInset;
      marginV = this.margin.topInset + this.margin.bottomInset;
    }
    const width = Math.max(this[$extra].width + marginH, this.w || 0);
    const height = Math.max(this[$extra].height + marginV, this.h || 0);
    const bbox = [this.x, this.y, width, height];
    if (this.w === "") {
      style.width = measureToString(width);
    }
    if (this.h === "") {
      style.height = measureToString(height);
    }
    const html = {
      name: "div",
      attributes,
      children,
    };
    const assist = this.assist ? this.assist[$toHTML]() : null;
    if (assist) {
      html.attributes.title = assist;
    }
    const result = HTMLResult.success(createWrapper(this, html), bbox);
    if (this.breakAfter.children.length >= 1) {
      const breakAfter = this.breakAfter.children[0];
      if (handleBreak(breakAfter)) {
        this[$extra].afterBreakAfter = result;
        return HTMLResult.breakNode(breakAfter);
      }
    }