Hello guys, I'm trying to do taint analysis in v8 with its ignition interpreter. I want to be noticed whenever a JS object is allocated. However, I cannot find the object allocation code in the interpreter.Currently I have located the v8 bytecode generating process such as the code following:void BytecodeGenerator::VisitDeclarations(Declaration::List* declarations) {
RegisterAllocationScope register_scope(this);
DCHECK(globals_builder()->empty());
for (Declaration* decl : *declarations) {
RegisterAllocationScope register_scope(this);
Visit(decl);
}
if (globals_builder()->empty()) return;
globals_builder()->set_constant_pool_entry(
builder()->AllocateDeferredConstantPoolEntry());
int encoded_flags = DeclareGlobalsEvalFlag::encode(info()->is_eval());
// Emit code to declare globals.
RegisterList args = register_allocator()->NewRegisterList(3);
builder()
->LoadConstantPoolEntry(globals_builder()->constant_pool_entry())
.StoreAccumulatorInRegister(args[0])
.LoadLiteral(Smi::FromInt(encoded_flags))
.StoreAccumulatorInRegister(args[1])
.MoveRegister(Register::function_closure(), args[2])
.CallRuntime(Runtime::kDeclareGlobals, args);
// Push and reset globals builder.
global_declarations_.push_back(globals_builder());
globals_builder_ = new (zone()) GlobalDeclarationsBuilder(zone());
}But I cannot find the object allocation process. Can you guys give me some advice about it?