The following code is flagged as dead (since it's *replacing* rather than updating the existing Object):
https://github.com/mozilla/pdf.js/blob/4483cba72410027acf46630ebf252ae529704476/src/core/xfa/template.js#L2336-L2339
according to the alert in https://github.com/mozilla/pdf.js/security/code-scanning/103?query=ref%3Arefs%2Fheads%2Fmaster

Looking at the surrounding code, I can see a couple of possibilities here:
 1. This is indeed just dead code, which should be removed.
 2. The code should be moved up, and placed just *above* the previous block instead.
 3. There should be other, more invasive, changes made to this code...

/cc @calixteman Which solution is correct here?
Assuming it's either option 1 or 2, I can submit a patch to fix this.
}
      borderDims = getBorderDims(this.ui[$getExtra]());
      uiW += borderDims.w;
      uiH += borderDims.h;
      if (this.caption) {
        const { w, h, isBroken } = this.caption[$getExtra](availableSpace);
        
        
        if (isBroken && this[$getSubformParent]()[$isThereMoreWidth]()) {
          this[$popPara]();
          return HTMLResult.FAILURE;
        }
        width = w;
        height = h;
        switch (this.caption.placement) {
          case "left":
          case "right":
          case "inline":
            width += uiW;
            break;
          case "top":
          case "bottom":
            height += uiH;
            break;
        }
      } else {
        width = uiW;
        height = uiH;
      }
      if (width && this.w === "") {