The following code is flagged as dead (since it's *replacing* rather than updating the existing Object):
https://github.com/mozilla/pdf.js/blob/4483cba72410027acf46630ebf252ae529704476/src/core/xfa/template.js#L2336-L2339
according to the alert in https://github.com/mozilla/pdf.js/security/code-scanning/103?query=ref%3Arefs%2Fheads%2Fmaster

Looking at the surrounding code, I can see a couple of possibilities here:
 1. This is indeed just dead code, which should be removed.
 2. The code should be moved up, and placed just *above* the previous block instead.
 3. There should be other, more invasive, changes made to this code...

/cc @calixteman Which solution is correct here?
Assuming it's either option 1 or 2, I can submit a patch to fix this.
const items = field.items;
      let displayedIndex = 0;
      let saveIndex = 0;
      if (items.children.length === 2) {
        displayedIndex = items.children[0].save;
        saveIndex = 1 - displayedIndex;
      }
      const displayed = items.children[displayedIndex][$toHTML]().html;
      const values = items.children[saveIndex][$toHTML]().html;
      let selected = false;
      const value = (field.value && field.value[$text]()) || "";
      for (let i = 0, ii = displayed.length; i < ii; i++) {
        const option = {
          name: "option",
          attributes: {
            value: values[i] || displayed[i],
          },
          value: displayed[i],
        };
        if (values[i] === value) {
          option.attributes.selected = selected = true;
        }
        children.push(option);
      }
      if (!selected) {
        children.splice(0, 0, {
          name: "option",
          attributes: {
            hidden: true,
            selected: true,