The following code is flagged as dead (since it's *replacing* rather than updating the existing Object):
https://github.com/mozilla/pdf.js/blob/4483cba72410027acf46630ebf252ae529704476/src/core/xfa/template.js#L2336-L2339
according to the alert in https://github.com/mozilla/pdf.js/security/code-scanning/103?query=ref%3Arefs%2Fheads%2Fmaster

Looking at the surrounding code, I can see a couple of possibilities here:
 1. This is indeed just dead code, which should be removed.
 2. The code should be moved up, and placed just *above* the previous block instead.
 3. There should be other, more invasive, changes made to this code...

/cc @calixteman Which solution is correct here?
Assuming it's either option 1 or 2, I can submit a patch to fix this.
startIndex = 0;
        if (leader) {
          htmlContentAreas[i].children.push(leader[$toHTML](space).html);
          leader = null;
        }
        if (trailer) {
          htmlContentAreas[i].children.push(trailer[$toHTML](space).html);
          trailer = null;
        }
        const html = root[$toHTML](space);
        if (html.success) {
          if (html.html) {
            hasSomething =
              hasSomething ||
              (html.html.children && html.html.children.length !== 0);
            htmlContentAreas[i].children.push(html.html);
          } else if (!hasSomething) {
            mainHtml.children.pop();
          }
          return mainHtml;
        }
        if (html.isBreak()) {
          const node = html.breakNode;
          flush(i);
          if (node.targetType === "auto") {
            continue;
          }
          if (node.leader) {
            leader = this[$searchNode](node.leader, node[$getParent]());
            leader = leader ? leader[0] : null;