panoptichrome_patches.diff

diff --git a/BUILD.gn b/BUILD.gn
index c13cf05..d859545 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -3017,6 +3017,8 @@ v8_header_set("v8_internal_headers") {
     "src/common/assert-scope.h",
     "src/common/checks.h",
     "src/common/code-memory-access-inl.h",
+    "src/commons.cc",
+    "src/commons.h",
     "src/common/code-memory-access.h",
     "src/common/high-allocation-throughput-scope.h",
     "src/common/message-template.h",
@@ -5117,6 +5119,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/runtime/runtime-shadow-realm.cc",
     "src/runtime/runtime-strings.cc",
     "src/runtime/runtime-symbol.cc",
+    "src/runtime/runtime-taint.cc",
+    "src/runtime/runtime-taint.h",
     "src/runtime/runtime-temporal.cc",
     "src/runtime/runtime-test.cc",
     "src/runtime/runtime-trace.cc",
diff --git a/src/builtins/builtins-api.cc b/src/builtins/builtins-api.cc
index 94120f0..f160d7c 100644
--- a/src/builtins/builtins-api.cc
+++ b/src/builtins/builtins-api.cc
@@ -182,7 +182,6 @@ MaybeHandle<Object> Builtins::InvokeApiFunction(
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, receiver, Object::ConvertReceiver(isolate, receiver), Object);
   }
-
   // We assume that all lazy accessor pairs have been instantiated when setting
   // a break point on any API function.
   DCHECK(!Handle<FunctionTemplateInfo>::cast(function)->BreakAtEntry());
@@ -192,7 +191,7 @@ MaybeHandle<Object> Builtins::InvokeApiFunction(
   for (int i = 0; i < argc; ++i) {
     argv[i + 1] = args[i]->ptr();
   }
-
+  
   RelocatableArguments arguments(isolate, argv.size(), argv.data());
   if (is_construct) {
     return HandleApiCallHelper<true>(isolate, new_target, function, receiver,
diff --git a/src/codegen/code-stub-assembler.cc b/src/codegen/code-stub-assembler.cc
index d6f303c..a8213f2 100644
--- a/src/codegen/code-stub-assembler.cc
+++ b/src/codegen/code-stub-assembler.cc
@@ -251,13 +251,13 @@ TNode<Smi> CodeStubAssembler::NoContextConstant() {
   return SmiConstant(Context::kNoContext);
 }
 
-#define HEAP_CONSTANT_ACCESSOR(rootIndexName, rootAccessorName, name)        \
-  TNode<std::remove_pointer<std::remove_reference<decltype(                  \
-      std::declval<Heap>().rootAccessorName())>::type>::type>                \
-      CodeStubAssembler::name##Constant() {                                  \
-    return UncheckedCast<std::remove_pointer<std::remove_reference<decltype( \
-        std::declval<Heap>().rootAccessorName())>::type>::type>(             \
-        LoadRoot(RootIndex::k##rootIndexName));                              \
+#define HEAP_CONSTANT_ACCESSOR(rootIndexName, rootAccessorName, name)     \
+  TNode<std::remove_pointer<std::remove_reference<                        \
+      decltype(std::declval<Heap>().rootAccessorName())>::type>::type>    \
+      CodeStubAssembler::name##Constant() {                               \
+    return UncheckedCast<std::remove_pointer<std::remove_reference<       \
+        decltype(std::declval<Heap>().rootAccessorName())>::type>::type>( \
+        LoadRoot(RootIndex::k##rootIndexName));                           \
   }
 HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR)
 #undef HEAP_CONSTANT_ACCESSOR
@@ -7495,36 +7495,37 @@ TNode<String> CodeStubAssembler::StringFromSingleCharCode(TNode<Int32T> code) {
   TVARIABLE(String, var_result);
 
   // Check if the {code} is a one-byte char code.
-  Label if_codeisonebyte(this), if_codeistwobyte(this, Label::kDeferred),
-      if_done(this);
-  Branch(Int32LessThanOrEqual(code, Int32Constant(String::kMaxOneByteCharCode)),
-         &if_codeisonebyte, &if_codeistwobyte);
-  BIND(&if_codeisonebyte);
-  {
-    // Load the isolate wide single character string cache.
-    TNode<FixedArray> cache = SingleCharacterStringTableConstant();
-    TNode<IntPtrT> code_index = Signed(ChangeUint32ToWord(code));
-
-    TNode<Object> entry = UnsafeLoadFixedArrayElement(cache, code_index);
-    CSA_DCHECK(this, Word32BinaryNot(IsUndefined(entry)));
-
-    // Return the entry from the {cache}.
-    var_result = CAST(entry);
-    Goto(&if_done);
-  }
+  // Label if_codeisonebyte(this), if_codeistwobyte(this, Label::kDeferred),
+  //     if_done(this);
+  // Branch(Int32LessThanOrEqual(code,
+  // Int32Constant(String::kMaxOneByteCharCode)),
+  //        &if_codeisonebyte, &if_codeistwobyte);
+  // BIND(&if_codeisonebyte);
+  // {
+  //   // Load the isolate wide single character string cache.
+  //   TNode<FixedArray> cache = SingleCharacterStringTableConstant();
+  //   TNode<IntPtrT> code_index = Signed(ChangeUint32ToWord(code));
+
+  //   TNode<Object> entry = UnsafeLoadFixedArrayElement(cache, code_index);
+  //   CSA_DCHECK(this, Word32BinaryNot(IsUndefined(entry)));
+
+  //   // Return the entry from the {cache}.
+  //   var_result = CAST(entry);
+  //   Goto(&if_done);
+  // }
 
-  BIND(&if_codeistwobyte);
-  {
-    // Allocate a new SeqTwoByteString for {code}.
-    TNode<String> result = AllocateSeqTwoByteString(1);
-    StoreNoWriteBarrier(
-        MachineRepresentation::kWord16, result,
-        IntPtrConstant(SeqTwoByteString::kHeaderSize - kHeapObjectTag), code);
-    var_result = result;
-    Goto(&if_done);
-  }
+  // BIND(&if_codeistwobyte);
+  // {
+  // Allocate a new SeqTwoByteString for {code}.
+  TNode<String> result = AllocateSeqTwoByteString(1);
+  StoreNoWriteBarrier(
+      MachineRepresentation::kWord16, result,
+      IntPtrConstant(SeqTwoByteString::kHeaderSize - kHeapObjectTag), code);
+  var_result = result;
+  // Goto(&if_done);
+  // }
 
-  BIND(&if_done);
+  // BIND(&if_done);
   return var_result.value();
 }
 
@@ -11488,21 +11489,21 @@ void CodeStubAssembler::StoreElementTypedArrayBigInt(TNode<RawPtrT> elements,
 
   MachineRepresentation rep = WordT::kMachineRepresentation;
 #if defined(V8_TARGET_BIG_ENDIAN)
-    if (!Is64()) {
-      StoreNoWriteBarrier(rep, elements, offset, var_high.value());
-      StoreNoWriteBarrier(rep, elements,
-                          IntPtrAdd(offset, IntPtrConstant(kSystemPointerSize)),
-                          var_low.value());
-    } else {
-      StoreNoWriteBarrier(rep, elements, offset, var_low.value());
-    }
-#else
+  if (!Is64()) {
+    StoreNoWriteBarrier(rep, elements, offset, var_high.value());
+    StoreNoWriteBarrier(rep, elements,
+                        IntPtrAdd(offset, IntPtrConstant(kSystemPointerSize)),
+                        var_low.value());
+  } else {
     StoreNoWriteBarrier(rep, elements, offset, var_low.value());
-    if (!Is64()) {
-      StoreNoWriteBarrier(rep, elements,
-                          IntPtrAdd(offset, IntPtrConstant(kSystemPointerSize)),
-                          var_high.value());
-    }
+  }
+#else
+  StoreNoWriteBarrier(rep, elements, offset, var_low.value());
+  if (!Is64()) {
+    StoreNoWriteBarrier(rep, elements,
+                        IntPtrAdd(offset, IntPtrConstant(kSystemPointerSize)),
+                        var_high.value());
+  }
 #endif
 }
 
@@ -15656,7 +15657,7 @@ TNode<BoolT> CodeStubAssembler::HasAsyncEventDelegate() {
 
 TNode<Uint32T> CodeStubAssembler::PromiseHookFlags() {
   return Load<Uint32T>(ExternalConstant(
-    ExternalReference::promise_hook_flags_address(isolate())));
+      ExternalReference::promise_hook_flags_address(isolate())));
 }
 
 TNode<BoolT> CodeStubAssembler::IsAnyPromiseHookEnabled(TNode<Uint32T> flags) {
@@ -15677,8 +15678,9 @@ TNode<BoolT> CodeStubAssembler::IsContextPromiseHookEnabled(
 }
 #endif
 
-TNode<BoolT> CodeStubAssembler::
-    IsIsolatePromiseHookEnabledOrHasAsyncEventDelegate(TNode<Uint32T> flags) {
+TNode<BoolT>
+CodeStubAssembler::IsIsolatePromiseHookEnabledOrHasAsyncEventDelegate(
+    TNode<Uint32T> flags) {
   uint32_t mask = Isolate::PromiseHookFields::HasIsolatePromiseHook::kMask |
                   Isolate::PromiseHookFields::HasAsyncEventDelegate::kMask;
   return IsSetWord32(flags, mask);
diff --git a/src/commons.cc b/src/commons.cc
new file mode 100644
index 0000000..e624967
--- /dev/null
+++ b/src/commons.cc
@@ -0,0 +1,267 @@
+#include "src/commons.h"
+
+#include <cstddef>
+#include <iostream>
+
+namespace v8 {
+namespace commons {
+
+void LinkedList::initialize() {
+  fake_head_.prev = fake_tail_.next = NULL;
+  fake_head_.next = &fake_tail_;
+  fake_tail_.prev = &fake_head_;
+  size_ = 0;
+}
+
+void LinkedList::destroy() {
+  ListNode *prev, *cur;
+  for (cur = fake_head_.next; cur != &fake_tail_;) {
+    prev = cur;
+    cur = cur->next;
+    delete prev;
+  }
+  initialize();
+}
+
+LinkedList::LinkedList() { initialize(); }
+
+LinkedList::~LinkedList() { destroy(); }
+
+static void IterateLinkedListCopy(void* key, void* value, void* data) {
+  LinkedList* list = (LinkedList*)data;
+  list->append(key, value);
+}
+
+LinkedList& LinkedList::operator=(const LinkedList& other) {
+  destroy();
+  other.iterate(IterateLinkedListCopy, this);
+  return *this;
+}
+
+LinkedList::LinkedList(LinkedList& other) {
+  initialize();
+  other.iterate(IterateLinkedListCopy, this);
+}
+
+void LinkedList::prepend(void* key, void* value) {
+  ListNode* node = new ListNode();
+  node->key = key;
+  node->value = value;
+
+  node->next = fake_head_.next;
+  node->prev = &fake_head_;
+  fake_head_.next->prev = node;
+  fake_head_.next = node;
+
+  size_ += 1;
+}
+
+void LinkedList::append(void* key, void* value) {
+  ListNode* node = new ListNode();
+  node->key = key;
+  node->value = value;
+
+  node->next = &fake_tail_;
+  node->prev = fake_tail_.prev;
+  fake_tail_.prev->next = node;
+  fake_tail_.prev = node;
+
+  size_ += 1;
+}
+
+void LinkedList::remove(void* key) {
+  ListNode* cur;
+  for (cur = &fake_head_; cur->next != &fake_tail_ && cur->next->key != key;
+       cur = cur->next) {
+    ;
+  }
+  if (cur->next != &fake_tail_) {
+    ListNode* p = cur->next;
+    cur->next = p->next;
+    p->next->prev = cur;
+    delete p;
+    size_ -= 1;
+  }
+}
+
+bool LinkedList::search(void* key) {
+  for (ListNode* cur = fake_head_.next; cur != &fake_tail_; cur = cur->next)
+    if (cur->key == key) return true;
+  return false;
+}
+
+void* LinkedList::get(void* key) {
+  for (ListNode* cur = fake_head_.next; cur != &fake_tail_; cur = cur->next)
+    if (cur->key == key) return cur->value;
+  return NULL;
+}
+
+void LinkedList::iterate(IterateCallback callback, void* data) const {
+  for (ListNode* cur = fake_head_.next; cur != &fake_tail_; cur = cur->next)
+    callback(cur->key, cur->value, data);
+}
+
+bool LinkedList::empty() { return (size_ == 0); }
+
+void* LinkedList::head_key() {
+  if (!empty()) return fake_head_.next->key;
+  return NULL;
+}
+
+void* LinkedList::head_value() {
+  if (!empty()) return fake_head_.next->value;
+  return NULL;
+}
+
+void* LinkedList::tail_key() {
+  if (!empty()) return fake_tail_.prev->key;
+  return NULL;
+}
+
+void* LinkedList::tail_value() {
+  if (!empty()) return fake_tail_.prev->value;
+  return NULL;
+}
+
+void LinkedList::pop_head() {
+  if (!empty()) {
+    ListNode* p = fake_head_.next;
+    fake_head_.next = p->next;
+    p->next->prev = &fake_head_;
+    delete p;
+    size_ -= 1;
+  }
+}
+
+void LinkedList::pop_tail() {
+  if (!empty()) {
+    ListNode* p = fake_tail_.prev;
+    fake_tail_.prev = p->prev;
+    p->prev->next = &fake_tail_;
+    delete p;
+    size_ -= 1;
+  }
+}
+
+void LinkedList::clear() { destroy(); }
+
+HashTable::HashTable() {
+  buckets_ = new LinkedList[kMinCapacity];
+  capacity_ = kMinCapacity;
+  size_ = 0;
+}
+
+HashTable::~HashTable() {
+  delete[] buckets_;
+  buckets_ = NULL;
+  capacity_ = 0;
+  size_ = 0;
+}
+
+int HashTable::hash_pointer(void* ptr, int mod) {
+  unsigned long long hash = reinterpret_cast<unsigned long long>(ptr);
+  hash = ~hash + (hash << 18);  // hash = (hash << 18) - hash - 1;
+  hash = hash ^ (hash >> 31);
+  hash = hash * 21;  // hash = (hash + (hash << 2)) + (hash << 4);
+  hash = hash ^ (hash >> 11);
+  hash = hash + (hash << 6);
+  hash = hash ^ (hash >> 22);
+  hash = hash % ((unsigned long)mod);
+
+  int temp = int(hash % ((unsigned long)mod));
+
+  CHECK((int)hash >= 0 && (int)hash < mod);
+  return temp;
+}
+
+void HashTable::insert(void* key, void* value) {
+  remove(key);  // Overwrite if duplicate key.
+  unsigned long long idx = hash_pointer(key, capacity_);
+  buckets_[idx].append(key, value);
+  size_ += 1;
+  check_load_factor();
+}
+
+void HashTable::remove(void* key) {
+  int idx = hash_pointer(key, capacity_);
+  if (buckets_[idx].search(key)) {
+    buckets_[idx].remove(key);
+    size_ -= 1;
+    check_load_factor();
+  }
+}
+
+bool HashTable::search(void* key) {
+  int idx = hash_pointer(key, capacity_);
+  return buckets_[idx].search(key);
+}
+
+void* HashTable::get(void* key) {
+  int idx = hash_pointer(key, capacity_);
+  return buckets_[idx].get(key);
+}
+
+void HashTable::clear() {
+  delete[] buckets_;
+  buckets_ = new LinkedList[kMinCapacity];
+  capacity_ = kMinCapacity;
+  size_ = 0;
+}
+
+void HashTable::iterate(IterateCallback callback, void* data) {
+  for (int idx = 0; idx < capacity_; idx++) {
+    buckets_[idx].iterate(callback, data);
+  }
+}
+
+bool HashTable::empty() { return (size_ == 0); }
+
+struct ResizeHashTable_Data {
+  LinkedList* new_buckets;
+  int new_capacity;
+};
+
+void HashTable::Iterate_ResizeHashTable(void* key, void* value, void* data) {
+  ResizeHashTable_Data* d = static_cast<ResizeHashTable_Data*>(data);
+  int idx = hash_pointer(key, d->new_capacity);
+  d->new_buckets[idx].append(key, value);
+}
+
+void HashTable::resize_table(int new_capacity) {
+  LinkedList* new_buckets = new LinkedList[new_capacity];
+  ResizeHashTable_Data data = {new_buckets, new_capacity};
+  this->iterate(Iterate_ResizeHashTable, &data);
+  delete[] buckets_;
+  buckets_ = new_buckets;
+  capacity_ = new_capacity;
+}
+
+void HashTable::check_load_factor() {
+  int upper_limit = (capacity_ / 4) * 3;
+  int lower_limit = (capacity_ / 4);
+  if (size_ < lower_limit && capacity_ / 2 >= kMinCapacity)
+    resize_table(capacity_ / 2);
+  else if (size_ > upper_limit)
+    resize_table(capacity_ * 2);
+}
+
+void* HashTable::removeAndReturnFirst() {
+  void* key=NULL;
+
+  if (!empty()) {
+    for (int idx = 0; idx < capacity_; idx++) {
+      if (!buckets_[idx].empty()) {
+        key = buckets_[idx].head_key();
+        buckets_[idx].pop_head();
+        size_ -= 1;
+        check_load_factor();
+        break;
+      }
+    }
+  }
+
+  return key;
+}
+
+}  // namespace commons
+}  // namespace v8
diff --git a/src/commons.h b/src/commons.h
new file mode 100644
index 0000000..2e11964
--- /dev/null
+++ b/src/commons.h
@@ -0,0 +1,132 @@
+
+#ifndef V8_COMMONS_H_
+#define V8_COMMONS_H_
+
+#include <unordered_set>
+
+#include "json.hpp"
+#include "src/base/logging.h"
+// using Address = uintptr_t;
+namespace v8 {
+namespace commons {
+
+class Properties {
+ public:
+  Properties() {
+    included_properties = nullptr;
+    excluded_properties = nullptr;
+  }
+  std::map<std::string, int>* included_properties;
+  std::map<std::string, int>* excluded_properties;
+  int obj_id;
+};
+
+class ParseInfoAndRCState {
+ public:
+  ParseInfoAndRCState() {
+    parse_info = nullptr;
+    ruc_state = nullptr;
+  }
+
+  ParseInfoAndRCState(void* pi, void* ruc) {
+    parse_info = pi;
+    ruc_state = ruc;
+  }
+
+  void* parse_info;  // ParseInfo
+  void* ruc_state;   // ReusableUnoptimizedCompileState
+};
+
+typedef void (*IterateCallback)(void* key, void* value, void* data);
+
+// Doubly-linked list.
+class LinkedList {
+ public:
+  LinkedList();
+
+  LinkedList(LinkedList& other);
+
+  ~LinkedList();
+
+  LinkedList& operator=(const LinkedList& other);
+
+  bool empty();
+
+  void prepend(void* key, void* value);
+  void append(void* key, void* value);
+  void remove(void* key);
+  bool search(void* key);
+  void* get(void* key);
+
+  void* head_key();
+  void* head_value();
+  void* tail_key();
+  void* tail_value();
+
+  void pop_head();
+  void pop_tail();
+
+  void clear();
+
+  void iterate(IterateCallback callback, void* data) const;
+
+  int size() { return size_; }
+
+ private:
+  void initialize();
+  void destroy();
+
+  struct ListNode {
+    void* key;
+    void* value;
+    struct ListNode* prev;
+    struct ListNode* next;
+  };
+
+  ListNode fake_head_;
+  ListNode fake_tail_;
+  int size_;
+};
+
+// Hash with chaining.
+class HashTable {
+ public:
+  HashTable();
+
+  ~HashTable();
+
+  bool empty();
+
+  void insert(void* key, void* value);
+  void remove(void* key);
+  bool search(void* key);
+  void* get(void* key);
+
+  void clear();
+
+  void iterate(IterateCallback callback, void* data);
+
+  int size() { return size_; }
+
+  int capacity() { return capacity_; }
+
+  void* removeAndReturnFirst();
+
+  static int hash_pointer(void* ptr, int mod);
+
+ private:
+  static void Iterate_ResizeHashTable(void* key, void* value, void* data);
+  void resize_table(int new_capacity);
+  void check_load_factor();
+
+  static const int kMinCapacity = 8;
+
+  LinkedList* buckets_;
+  int capacity_;  // Number of buckets.
+  int size_;      // Total number of keys.
+};
+
+}  // namespace commons
+}  // namespace v8
+
+#endif
\ No newline at end of file
diff --git a/src/compiler/js-call-reducer.cc b/src/compiler/js-call-reducer.cc
index b0c7907..9e6e1e7 100644
--- a/src/compiler/js-call-reducer.cc
+++ b/src/compiler/js-call-reducer.cc
@@ -3821,227 +3821,240 @@ FastApiCallFunctionVector CanOptimizeFastCall(
 
 Reduction JSCallReducer::ReduceCallApiFunction(Node* node,
                                                SharedFunctionInfoRef shared) {
-  JSCallNode n(node);
-  CallParameters const& p = n.Parameters();
-  int const argc = p.arity_without_implicit_args();
-  Node* target = n.target();
-  Node* global_proxy = jsgraph()->Constant(
-      native_context().global_proxy_object(broker()), broker());
-  Node* receiver = (p.convert_mode() == ConvertReceiverMode::kNullOrUndefined)
-                       ? global_proxy
-                       : n.receiver();
-  Node* holder;
-  Node* context = n.context();
-  Effect effect = n.effect();
-  Control control = n.control();
-  FrameState frame_state = n.frame_state();
-
-  if (!shared.function_template_info(broker()).has_value()) {
-    TRACE_BROKER_MISSING(
-        broker(), "FunctionTemplateInfo for function with SFI " << shared);
-    return NoChange();
-  }
-
-  // See if we can optimize this API call to {shared}.
-  FunctionTemplateInfoRef function_template_info(
-      shared.function_template_info(broker()).value());
-
-  if (function_template_info.accept_any_receiver() &&
-      function_template_info.is_signature_undefined(broker())) {
-    // We might be able to
-    // optimize the API call depending on the {function_template_info}.
-    // If the API function accepts any kind of {receiver}, we only need to
-    // ensure that the {receiver} is actually a JSReceiver at this point,
-    // and also pass that as the {holder}. There are two independent bits
-    // here:
-    //
-    //  a. When the "accept any receiver" bit is set, it means we don't
-    //     need to perform access checks, even if the {receiver}'s map
-    //     has the "needs access check" bit set.
-    //  b. When the {function_template_info} has no signature, we don't
-    //     need to do the compatible receiver check, since all receivers
-    //     are considered compatible at that point, and the {receiver}
-    //     will be pass as the {holder}.
-    //
-    receiver = holder = effect =
-        graph()->NewNode(simplified()->ConvertReceiver(p.convert_mode()),
-                         receiver, global_proxy, effect, control);
-  } else {
-    // Try to infer the {receiver} maps from the graph.
-    MapInference inference(broker(), receiver, effect);
-    if (inference.HaveMaps()) {
-      ZoneRefSet<Map> const& receiver_maps = inference.GetMaps();
-      MapRef first_receiver_map = receiver_maps[0];
-
-      // See if we can constant-fold the compatible receiver checks.
-      HolderLookupResult api_holder =
-          function_template_info.LookupHolderOfExpectedType(broker(),
-                                                            first_receiver_map);
-      if (api_holder.lookup == CallOptimization::kHolderNotFound) {
-        return inference.NoChange();
-      }
-
-      // Check that all {receiver_maps} are actually JSReceiver maps and
-      // that the {function_template_info} accepts them without access
-      // checks (even if "access check needed" is set for {receiver}).
-      //
-      // Note that we don't need to know the concrete {receiver} maps here,
-      // meaning it's fine if the {receiver_maps} are unreliable, and we also
-      // don't need to install any stability dependencies, since the only
-      // relevant information regarding the {receiver} is the Map::constructor
-      // field on the root map (which is different from the JavaScript exposed
-      // "constructor" property) and that field cannot change.
-      //
-      // So if we know that {receiver} had a certain constructor at some point
-      // in the past (i.e. it had a certain map), then this constructor is going
-      // to be the same later, since this information cannot change with map
-      // transitions.
-      //
-      // The same is true for the instance type, e.g. we still know that the
-      // instance type is JSObject even if that information is unreliable, and
-      // the "access check needed" bit, which also cannot change later.
-      CHECK(first_receiver_map.IsJSReceiverMap());
-      CHECK(!first_receiver_map.is_access_check_needed() ||
-            function_template_info.accept_any_receiver());
-
-      for (size_t i = 1; i < receiver_maps.size(); ++i) {
-        MapRef receiver_map = receiver_maps[i];
-        HolderLookupResult holder_i =
-            function_template_info.LookupHolderOfExpectedType(broker(),
-                                                              receiver_map);
-
-        if (api_holder.lookup != holder_i.lookup) return inference.NoChange();
-        DCHECK(holder_i.lookup == CallOptimization::kHolderFound ||
-               holder_i.lookup == CallOptimization::kHolderIsReceiver);
-        if (holder_i.lookup == CallOptimization::kHolderFound) {
-          DCHECK(api_holder.holder.has_value() && holder_i.holder.has_value());
-          if (!api_holder.holder->equals(*holder_i.holder)) {
-            return inference.NoChange();
-          }
-        }
-
-        CHECK(receiver_map.IsJSReceiverMap());
-        CHECK(!receiver_map.is_access_check_needed() ||
-              function_template_info.accept_any_receiver());
-      }
-
-      if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation &&
-          !inference.RelyOnMapsViaStability(dependencies())) {
-        // We were not able to make the receiver maps reliable without map
-        // checks but doing map checks would lead to deopt loops, so give up.
-        return inference.NoChange();
-      }
+  // JSCallNode n(node);
+  // CallParameters const& p = n.Parameters();
+  // int const argc = p.arity_without_implicit_args();
+  // Node* target = n.target();
+  // Node* global_proxy = jsgraph()->Constant(
+  //     native_context().global_proxy_object(broker()), broker());
+  // Node* receiver = (p.convert_mode() ==
+  // ConvertReceiverMode::kNullOrUndefined)
+  //                      ? global_proxy
+  //                      : n.receiver();
+  // Node* holder;
+  // Node* context = n.context();
+  // Effect effect = n.effect();
+  // Control control = n.control();
+  // FrameState frame_state = n.frame_state();
+
+  // if (!shared.function_template_info(broker()).has_value()) {
+  //   TRACE_BROKER_MISSING(
+  //       broker(), "FunctionTemplateInfo for function with SFI " << shared);
+  //   return NoChange();
+  // }
+
+  // // See if we can optimize this API call to {shared}.
+  // FunctionTemplateInfoRef function_template_info(
+  //     shared.function_template_info(broker()).value());
+
+  // if (function_template_info.accept_any_receiver() &&
+  //     function_template_info.is_signature_undefined(broker())) {
+  //   // We might be able to
+  //   // optimize the API call depending on the {function_template_info}.
+  //   // If the API function accepts any kind of {receiver}, we only need to
+  //   // ensure that the {receiver} is actually a JSReceiver at this point,
+  //   // and also pass that as the {holder}. There are two independent bits
+  //   // here:
+  //   //
+  //   //  a. When the "accept any receiver" bit is set, it means we don't
+  //   //     need to perform access checks, even if the {receiver}'s map
+  //   //     has the "needs access check" bit set.
+  //   //  b. When the {function_template_info} has no signature, we don't
+  //   //     need to do the compatible receiver check, since all receivers
+  //   //     are considered compatible at that point, and the {receiver}
+  //   //     will be pass as the {holder}.
+  //   //
+  //   receiver = holder = effect =
+  //       graph()->NewNode(simplified()->ConvertReceiver(p.convert_mode()),
+  //                        receiver, global_proxy, effect, control);
+  // } else {
+  //   // Try to infer the {receiver} maps from the graph.
+  //   MapInference inference(broker(), receiver, effect);
+  //   if (inference.HaveMaps()) {
+  //     ZoneRefSet<Map> const& receiver_maps = inference.GetMaps();
+  //     MapRef first_receiver_map = receiver_maps[0];
+
+  //     // See if we can constant-fold the compatible receiver checks.
+  //     HolderLookupResult api_holder =
+  //         function_template_info.LookupHolderOfExpectedType(broker(),
+  //                                                           first_receiver_map);
+  //     if (api_holder.lookup == CallOptimization::kHolderNotFound) {
+  //       return inference.NoChange();
+  //     }
 
-      // TODO(neis): The maps were used in a way that does not actually require
-      // map checks or stability dependencies.
-      inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,
-                                          control, p.feedback());
+  //     // Check that all {receiver_maps} are actually JSReceiver maps and
+  //     // that the {function_template_info} accepts them without access
+  //     // checks (even if "access check needed" is set for {receiver}).
+  //     //
+  //     // Note that we don't need to know the concrete {receiver} maps here,
+  //     // meaning it's fine if the {receiver_maps} are unreliable, and we also
+  //     // don't need to install any stability dependencies, since the only
+  //     // relevant information regarding the {receiver} is the
+  //     Map::constructor
+  //     // field on the root map (which is different from the JavaScript
+  //     exposed
+  //     // "constructor" property) and that field cannot change.
+  //     //
+  //     // So if we know that {receiver} had a certain constructor at some
+  //     point
+  //     // in the past (i.e. it had a certain map), then this constructor is
+  //     going
+  //     // to be the same later, since this information cannot change with map
+  //     // transitions.
+  //     //
+  //     // The same is true for the instance type, e.g. we still know that the
+  //     // instance type is JSObject even if that information is unreliable,
+  //     and
+  //     // the "access check needed" bit, which also cannot change later.
+  //     CHECK(first_receiver_map.IsJSReceiverMap());
+  //     CHECK(!first_receiver_map.is_access_check_needed() ||
+  //           function_template_info.accept_any_receiver());
+
+  //     for (size_t i = 1; i < receiver_maps.size(); ++i) {
+  //       MapRef receiver_map = receiver_maps[i];
+  //       HolderLookupResult holder_i =
+  //           function_template_info.LookupHolderOfExpectedType(broker(),
+  //                                                             receiver_map);
+
+  //       if (api_holder.lookup != holder_i.lookup) return
+  //       inference.NoChange(); DCHECK(holder_i.lookup ==
+  //       CallOptimization::kHolderFound ||
+  //              holder_i.lookup == CallOptimization::kHolderIsReceiver);
+  //       if (holder_i.lookup == CallOptimization::kHolderFound) {
+  //         DCHECK(api_holder.holder.has_value() &&
+  //         holder_i.holder.has_value()); if
+  //         (!api_holder.holder->equals(*holder_i.holder)) {
+  //           return inference.NoChange();
+  //         }
+  //       }
+
+  //       CHECK(receiver_map.IsJSReceiverMap());
+  //       CHECK(!receiver_map.is_access_check_needed() ||
+  //             function_template_info.accept_any_receiver());
+  //     }
 
-      // Determine the appropriate holder for the {lookup}.
-      holder = api_holder.lookup == CallOptimization::kHolderFound
-                   ? jsgraph()->Constant(*api_holder.holder, broker())
-                   : receiver;
-    } else {
-      // We don't have enough information to eliminate the access check
-      // and/or the compatible receiver check, so use the generic builtin
-      // that does those checks dynamically. This is still significantly
-      // faster than the generic call sequence.
-      Builtin builtin_name;
-      if (function_template_info.accept_any_receiver()) {
-        builtin_name = Builtin::kCallFunctionTemplate_CheckCompatibleReceiver;
-      } else if (function_template_info.is_signature_undefined(broker())) {
-        builtin_name = Builtin::kCallFunctionTemplate_CheckAccess;
-      } else {
-        builtin_name =
-            Builtin::kCallFunctionTemplate_CheckAccessAndCompatibleReceiver;
-      }
+  //     if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation &&
+  //         !inference.RelyOnMapsViaStability(dependencies())) {
+  //       // We were not able to make the receiver maps reliable without map
+  //       // checks but doing map checks would lead to deopt loops, so give up.
+  //       return inference.NoChange();
+  //     }
 
-      // The CallFunctionTemplate builtin requires the {receiver} to be
-      // an actual JSReceiver, so make sure we do the proper conversion
-      // first if necessary.
-      receiver = holder = effect =
-          graph()->NewNode(simplified()->ConvertReceiver(p.convert_mode()),
-                           receiver, global_proxy, effect, control);
-
-      Callable callable = Builtins::CallableFor(isolate(), builtin_name);
-      auto call_descriptor = Linkage::GetStubCallDescriptor(
-          graph()->zone(), callable.descriptor(),
-          argc + 1 /* implicit receiver */, CallDescriptor::kNeedsFrameState);
-      node->RemoveInput(n.FeedbackVectorIndex());
-      node->InsertInput(graph()->zone(), 0,
-                        jsgraph()->HeapConstant(callable.code()));
-      node->ReplaceInput(1,
-                         jsgraph()->Constant(function_template_info, broker()));
-      node->InsertInput(graph()->zone(), 2,
-                        jsgraph()->Constant(JSParameterCount(argc)));
-      node->ReplaceInput(3, receiver);       // Update receiver input.
-      node->ReplaceInput(6 + argc, effect);  // Update effect input.
-      NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
-      return Changed(node);
-    }
-  }
+  //     // TODO(neis): The maps were used in a way that does not actually
+  //     require
+  //     // map checks or stability dependencies.
+  //     inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,
+  //                                         control, p.feedback());
+
+  //     // Determine the appropriate holder for the {lookup}.
+  //     holder = api_holder.lookup == CallOptimization::kHolderFound
+  //                  ? jsgraph()->Constant(*api_holder.holder, broker())
+  //                  : receiver;
+  //   } else {
+  //     // We don't have enough information to eliminate the access check
+  //     // and/or the compatible receiver check, so use the generic builtin
+  //     // that does those checks dynamically. This is still significantly
+  //     // faster than the generic call sequence.
+  //     Builtin builtin_name;
+  //     if (function_template_info.accept_any_receiver()) {
+  //       builtin_name =
+  //       Builtin::kCallFunctionTemplate_CheckCompatibleReceiver;
+  //     } else if (function_template_info.is_signature_undefined(broker())) {
+  //       builtin_name = Builtin::kCallFunctionTemplate_CheckAccess;
+  //     } else {
+  //       builtin_name =
+  //           Builtin::kCallFunctionTemplate_CheckAccessAndCompatibleReceiver;
+  //     }
 
-  // TODO(turbofan): Consider introducing a JSCallApiCallback operator for
-  // this and lower it during JSGenericLowering, and unify this with the
-  // JSNativeContextSpecialization::InlineApiCall method a bit.
-  if (!function_template_info.call_code(broker()).has_value()) {
-    TRACE_BROKER_MISSING(broker(), "call code for function template info "
-                                       << function_template_info);
+  //     // The CallFunctionTemplate builtin requires the {receiver} to be
+  //     // an actual JSReceiver, so make sure we do the proper conversion
+  //     // first if necessary.
+  //     receiver = holder = effect =
+  //         graph()->NewNode(simplified()->ConvertReceiver(p.convert_mode()),
+  //                          receiver, global_proxy, effect, control);
+
+  //     Callable callable = Builtins::CallableFor(isolate(), builtin_name);
+  //     auto call_descriptor = Linkage::GetStubCallDescriptor(
+  //         graph()->zone(), callable.descriptor(),
+  //         argc + 1 /* implicit receiver */,
+  //         CallDescriptor::kNeedsFrameState);
+  //     node->RemoveInput(n.FeedbackVectorIndex());
+  //     node->InsertInput(graph()->zone(), 0,
+  //                       jsgraph()->HeapConstant(callable.code()));
+  //     node->ReplaceInput(1,
+  //                        jsgraph()->Constant(function_template_info,
+  //                        broker()));
+  //     node->InsertInput(graph()->zone(), 2,
+  //                       jsgraph()->Constant(JSParameterCount(argc)));
+  //     node->ReplaceInput(3, receiver);       // Update receiver input.
+  //     node->ReplaceInput(6 + argc, effect);  // Update effect input.
+  //     NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  //     return Changed(node);
+  //   }
+  // }
+
+  // // TODO(turbofan): Consider introducing a JSCallApiCallback operator for
+  // // this and lower it during JSGenericLowering, and unify this with the
+  // // JSNativeContextSpecialization::InlineApiCall method a bit.
+  // if (!function_template_info.call_code(broker()).has_value()) {
+  //   TRACE_BROKER_MISSING(broker(), "call code for function template info "
+  //                                      << function_template_info);
     return NoChange();
-  }
-
-  // Handles overloaded functions.
-
-  FastApiCallFunctionVector c_candidate_functions = CanOptimizeFastCall(
-      broker(), graph()->zone(), function_template_info, argc);
-  DCHECK_LE(c_candidate_functions.size(), 2);
-
-  // TODO(v8:13600): Support exception handling for FastApiCall nodes.
-  if (!c_candidate_functions.empty() &&
-      !NodeProperties::IsExceptionalCall(node)) {
-    FastApiCallReducerAssembler a(this, node, function_template_info,
-                                  c_candidate_functions, receiver, holder,
-                                  shared, target, argc, effect);
-    Node* fast_call_subgraph = a.ReduceFastApiCall();
-    ReplaceWithSubgraph(&a, fast_call_subgraph);
-
-    return Replace(fast_call_subgraph);
-  }
-
-  // Slow call
-
-  CallHandlerInfoRef call_handler_info =
-      *function_template_info.call_code(broker());
-  Callable call_api_callback = Builtins::CallableFor(
-      isolate(), call_handler_info.object()->IsSideEffectCallHandlerInfo()
-                     ? Builtin::kCallApiCallbackWithSideEffects
-                     : Builtin::kCallApiCallbackNoSideEffects);
-  CallInterfaceDescriptor cid = call_api_callback.descriptor();
-  auto call_descriptor =
-      Linkage::GetStubCallDescriptor(graph()->zone(), cid, argc + 1 /*
-     implicit receiver */, CallDescriptor::kNeedsFrameState);
-  ApiFunction api_function(call_handler_info.callback());
-  ExternalReference function_reference = ExternalReference::Create(
-      &api_function, ExternalReference::DIRECT_API_CALL);
-
-  Node* continuation_frame_state = CreateGenericLazyDeoptContinuationFrameState(
-      jsgraph(), shared, target, context, receiver, frame_state);
-
-  node->RemoveInput(n.FeedbackVectorIndex());
-  node->InsertInput(graph()->zone(), 0,
-                    jsgraph()->HeapConstant(call_api_callback.code()));
-  node->ReplaceInput(1, jsgraph()->ExternalConstant(function_reference));
-  node->InsertInput(graph()->zone(), 2, jsgraph()->Constant(argc));
-  node->InsertInput(
-      graph()->zone(), 3,
-      jsgraph()->Constant(call_handler_info.data(broker()), broker()));
-  node->InsertInput(graph()->zone(), 4, holder);
-  node->ReplaceInput(5, receiver);  // Update receiver input.
-  // 6 + argc is context input.
-  node->ReplaceInput(6 + argc + 1, continuation_frame_state);
-  node->ReplaceInput(6 + argc + 2, effect);
-  NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
-  return Changed(node);
+  // }
+  //
+  // // Handles overloaded functions.
+
+  // FastApiCallFunctionVector c_candidate_functions = CanOptimizeFastCall(
+  //     broker(), graph()->zone(), function_template_info, argc);
+  // DCHECK_LE(c_candidate_functions.size(), 2);
+
+  // // TODO(v8:13600): Support exception handling for FastApiCall nodes.
+  // if (!c_candidate_functions.empty() &&
+  //     !NodeProperties::IsExceptionalCall(node)) {
+  //   FastApiCallReducerAssembler a(this, node, function_template_info,
+  //                                 c_candidate_functions, receiver, holder,
+  //                                 shared, target, argc, effect);
+  //   Node* fast_call_subgraph = a.ReduceFastApiCall();
+  //   ReplaceWithSubgraph(&a, fast_call_subgraph);
+
+  //   return Replace(fast_call_subgraph);
+  // }
+
+  // // Slow call
+
+  // CallHandlerInfoRef call_handler_info =
+  //     *function_template_info.call_code(broker());
+  // Callable call_api_callback = Builtins::CallableFor(
+  //     isolate(), call_handler_info.object()->IsSideEffectCallHandlerInfo()
+  //                    ? Builtin::kCallApiCallbackWithSideEffects
+  //                    : Builtin::kCallApiCallbackNoSideEffects);
+  // CallInterfaceDescriptor cid = call_api_callback.descriptor();
+  // auto call_descriptor =
+  //     Linkage::GetStubCallDescriptor(graph()->zone(), cid, argc + 1 /*
+  //    implicit receiver */, CallDescriptor::kNeedsFrameState);
+  // ApiFunction api_function(call_handler_info.callback());
+  // ExternalReference function_reference = ExternalReference::Create(
+  //     &api_function, ExternalReference::DIRECT_API_CALL);
+
+  // Node* continuation_frame_state =
+  // CreateGenericLazyDeoptContinuationFrameState(
+  //     jsgraph(), shared, target, context, receiver, frame_state);
+
+  // node->RemoveInput(n.FeedbackVectorIndex());
+  // node->InsertInput(graph()->zone(), 0,
+  //                   jsgraph()->HeapConstant(call_api_callback.code()));
+  // node->ReplaceInput(1, jsgraph()->ExternalConstant(function_reference));
+  // node->InsertInput(graph()->zone(), 2, jsgraph()->Constant(argc));
+  // node->InsertInput(
+  //     graph()->zone(), 3,
+  //     jsgraph()->Constant(call_handler_info.data(broker()), broker()));
+  // node->InsertInput(graph()->zone(), 4, holder);
+  // node->ReplaceInput(5, receiver);  // Update receiver input.
+  // // 6 + argc is context input.
+  // node->ReplaceInput(6 + argc + 1, continuation_frame_state);
+  // node->ReplaceInput(6 + argc + 2, effect);
+  // NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
+  // return Changed(node);
 }
 
 namespace {
diff --git a/src/execution/execution.cc b/src/execution/execution.cc
index 2fccce1..ac8e453 100644
--- a/src/execution/execution.cc
+++ b/src/execution/execution.cc
@@ -19,7 +19,6 @@
 
 namespace v8 {
 namespace internal {
-
 namespace {
 
 Handle<Object> NormalizeReceiver(Isolate* isolate, Handle<Object> receiver) {
diff --git a/src/execution/isolate.cc b/src/execution/isolate.cc
index c437bd1..bef0ee0 100644
--- a/src/execution/isolate.cc
+++ b/src/execution/isolate.cc
@@ -4,11 +4,13 @@
 
 #include "src/execution/isolate.h"
 
+#include <fcntl.h>
 #include <stdlib.h>
 
 #include <atomic>
 #include <cstdint>
 #include <fstream>
+#include <iostream>
 #include <memory>
 #include <sstream>
 #include <string>
@@ -34,6 +36,7 @@
 #include "src/codegen/assembler-inl.h"
 #include "src/codegen/compilation-cache.h"
 #include "src/codegen/flush-instruction-cache.h"
+#include "src/codegen/unoptimized-compilation-info.h"
 #include "src/common/assert-scope.h"
 #include "src/common/globals.h"
 #include "src/common/ptr-compr-inl.h"
@@ -100,6 +103,7 @@
 #include "src/profiler/tracing-cpu-profiler.h"
 #include "src/regexp/regexp-stack.h"
 #include "src/roots/static-roots.h"
+#include "src/runtime/runtime-taint.h"
 #include "src/snapshot/embedded/embedded-data-inl.h"
 #include "src/snapshot/embedded/embedded-file-writer-interface.h"
 #include "src/snapshot/read-only-deserializer.h"
@@ -2482,9 +2486,9 @@ void Isolate::PrintCurrentStackTrace(std::ostream& out) {
 bool Isolate::ComputeLocation(MessageLocation* target) {
   DebuggableStackFrameIterator it(this);
   if (it.done()) return false;
-  // Compute the location from the function and the relocation info of the
-  // baseline code. For optimized code this will use the deoptimization
-  // information to get canonical location information.
+    // Compute the location from the function and the relocation info of the
+    // baseline code. For optimized code this will use the deoptimization
+    // information to get canonical location information.
 #if V8_ENABLE_WEBASSEMBLY
   wasm::WasmCodeRefScope code_ref_scope;
 #endif  // V8_ENABLE_WEBASSEMBLY
@@ -3805,6 +3809,987 @@ Isolate::~Isolate() {
   }
 }
 
+//   :: Begin Taint Changes
+
+void Isolate::InitTables() {
+  setRKDebugMode(true);
+
+  // HandleScope handle_scope(this);
+
+  taintBusiness = false;
+
+  garbage_collection_requests_ = 0;
+  max_objs = 0;
+  max_props = 0;
+
+  persistent_handles = NewPersistentHandles();
+
+  rk_ast_obj_map = new commons::HashTable();
+
+  rk_taint_table =
+      persistent_handles->NewHandle(EphemeronHashTable::New(this, 3200));
+
+  // std::cout << "\n Taint table PTR :: " << std::hex << rk_taint_table->ptr()
+  //           << std::flush;
+
+  tainted_functions =
+      persistent_handles->NewHandle(EphemeronHashTable::New(this, 3200));
+
+  // reusable_compile_state_ =
+  //    new ReusableUnoptimizedCompileState(this);
+
+  scope_dfg_cache = new commons::HashTable();
+  permanent_ast_cache = new commons::HashTable();
+  ast_cache = new commons::HashTable();
+  located_scope_and_node_cache_ = new commons::HashTable();
+  need_to_propagate = new commons::HashTable();
+
+  // std::cout << "calling loaddatabase";
+  loadDatabase(sources_database, "sources.json");
+  loadDatabase(sinks_database, "sinks.json");
+  parseIDL("idl_data.json");
+
+  // given an object, property search if a property is included or excluded in
+  // that object
+
+  // find if an object is present in source database or not, if it is then check
+  // if the property is present in excluded or included
+}
+
+void Isolate::maybeCollectGarbage() {
+#define GARBAGE_CEIL 50000
+
+  garbage_collection_requests_++;
+  if (garbage_collection_requests_ > GARBAGE_CEIL) {
+    // std::cout << "\nCompacting Garbage\n";
+    // // heap()->CollectAllGarbage(0, GarbageCollectionReason::kUnknown);
+
+    // heap()->CollectAllGarbage(0, GarbageCollectionReason::kUnknown);
+    // // heap()->CollectAllGarbage(OLD_SPACE,
+    // GarbageCollectionReason::kUnknown); heap()->CollectAllGarbage(NEW_SPACE,
+    // GarbageCollectionReason::kUnknown); heap()->CollectAllGarbage(MAP_SPACE,
+    // GarbageCollectionReason::kUnknown); heap()->CollectAllGarbage(CODE_SPACE,
+    // GarbageCollectionReason::kUnknown);
+    //   RO_SPACE,       // Immortal, immovable and immutable objects,
+    // OLD_SPACE,      // Old generation regular object space.
+    // CODE_SPACE,     // Old generation code object space, marked executable.
+    // MAP_SPACE,      // Old generation map object space, non-movable.
+    // LO_SPACE,       // Old generation large object space.
+    // CODE_LO_SPACE,  // Old generation large code object space.
+    // NEW_LO_SPACE,   // Young generation large object space.
+    // NEW_SPACE
+    garbage_collection_requests_ = 0;
+  }
+}
+
+void Isolate::parseIDL(std::string filename) {
+  std::ifstream ifs(filename);
+  if (!ifs.is_open()) {
+    std::cout << "Cannot load the IDL File" << std::endl;
+    exit(1);
+  }
+
+  nlohmann::json config = nlohmann::json::parse(ifs);
+
+  // commons::Properties* properties_data;
+
+  // std::map<std::string, int>* members = {};
+
+  // std::map<std::string, int>* members = new std::map<std::string, int>();
+
+  // int obj_id = 0;
+  // int t_max_props = 0;
+  int prop_id = 0;
+
+  for (auto& item : config.items()) {
+    // properties_data = new commons::Properties();
+    // properties_data->obj_id = obj_id++;
+
+    for (auto& inner_item : item.value().items()) {
+      if (inner_item.key() == "members") {
+        // members = new std::map<std::string, int>();
+        // prop_id = 0;
+        for (auto& prop : inner_item.value().items()) {
+          // members->insert({prop.value(), stoi(prop.key())});
+          // std::cout<<item.key() + "." + prop.value().get<std::string>();
+          name_prop_to_id.insert(
+              {item.key() + "." + prop.value().get<std::string>(), prop_id});
+          id_to_name_prop.push_back(item.key() + "." +
+                                    prop.value().get<std::string>());
+          prop_id++;
+        }
+
+      }
+
+      if (inner_item.key() == "parent") {
+        for (auto& prop : inner_item.value().items()) {
+          object_to_parent_map.insert(
+              {item.key(), prop.value().get<std::string>()});
+
+        }
+      }
+    }
+
+  }
+}
+
+void Isolate::loadDatabase(
+    std::unordered_map<std::string, commons::Properties*>* database,
+    std::string file_name) {
+  std::ifstream ifs(file_name);
+  if (!ifs.is_open()) {
+    std::cout << "Cannot load the Config File" << std::endl;
+    exit(1);
+  }
+
+  nlohmann::json config = nlohmann::json::parse(ifs);
+
+  commons::Properties* properties_data;
+
+  std::map<std::string, int>* included_props = {};
+  std::map<std::string, int>* excluded_props = {};
+  int obj_id = 0;
+  int prop_id;
+  int t_max_props = 0;
+
+  for (auto& item : config.items()) {
+
+
+    properties_data = new commons::Properties();
+
+    nlohmann::json outermost_key = item.value();
+
+    properties_data = new commons::Properties();
+    properties_data->obj_id = obj_id++;
+
+    if (outermost_key.is_string()) {
+      (*database)[outermost_key] = properties_data;
+      // std::cout<<item.value()<<std::endl;
+    } else {
+      if (outermost_key.is_object()) {
+        // prop_id = 0;
+        // {5, "Five"}
+        for (auto& inner_item : outermost_key.items()) {
+          if (inner_item.value().is_object()) {
+            nlohmann::json temp_obj = inner_item.value();
+            for (auto& element : temp_obj.items()) {
+              prop_id = 0;
+              if (element.key() == "includedProperties") {
+                included_props = new std::map<std::string, int>();
+                for (auto& prop : element.value().items()) {
+                  included_props->insert({prop.value(), prop_id++});
+                }
+                if (t_max_props < prop_id) t_max_props = prop_id;
+                properties_data->included_properties = included_props;
+              } else if (element.key() == "excludedProperties") {
+                excluded_props = new std::map<std::string, int>();
+                for (auto& prop : element.value().items()) {
+                  excluded_props->insert({prop.value(), prop_id++});
+                }
+                if (t_max_props < prop_id) t_max_props = prop_id;
+                properties_data->excluded_properties = excluded_props;
+              } else {
+                std::cout << "bad key in config file";
+              }
+            }
+
+            (*database)[inner_item.key()] = properties_data;
+          }
+        }
+      }
+    }
+  }
+  max_objs = obj_id;
+  max_props = t_max_props;
+}
+
+bool Isolate::IsValidObjectProperty(std::string object_name,
+                                    std::string property_name) {
+  if (name_prop_to_id.find(object_name + "." + property_name) !=
+      name_prop_to_id.end())
+    return true;
+
+  while (object_to_parent_map.find(object_name) != object_to_parent_map.end()) {
+    object_name = object_to_parent_map[object_name];
+    if (name_prop_to_id.find(object_name + "." + property_name) !=
+        name_prop_to_id.end())
+      return true;
+  }
+
+  return false;
+}
+
+bool Isolate::IsObjectPropertySource(std::string object_name,
+                                     std::string property_name) {
+  // std::cout<<"Inside ShouldTaintObjectProperty"<<std::endl;
+
+  // std::cout<<"Object Name::"<<object_name<<std::endl;
+  // std::cout<<"Property Name::"<<property_name<<std::endl;
+
+  if (!IsValidObjectProperty(object_name, property_name)) return false;
+
+  std::unordered_map<std::string, commons::Properties*> source_database =
+      *sources_database;
+
+  if (source_database.find(object_name) == source_database.end()) return false;
+
+  std::map<std::string, int>* t_included_properties =
+      source_database[object_name]->included_properties;
+  std::map<std::string, int>* t_excluded_properties =
+      source_database[object_name]->excluded_properties;
+
+  // taint every property of the object
+  if (t_included_properties == nullptr && t_excluded_properties == nullptr) {
+    return true;
+  }
+
+  // taint only the included properties
+  if (t_included_properties != nullptr && t_excluded_properties == nullptr) {
+    if (t_included_properties->find(property_name) !=
+        t_included_properties->end()) {
+      return true;
+    }
+  }
+
+  // taint if property is not excluded
+  if (t_included_properties == nullptr && t_excluded_properties != nullptr) {
+    if (t_excluded_properties->find(property_name) ==
+        t_excluded_properties->end()) {
+      return true;
+    }
+  }
+
+  // if both included and excluded are specified
+  if (t_included_properties != nullptr && t_excluded_properties != nullptr) {
+    std::cout << "\nBad Config";
+    return false;
+  }
+
+  // std::cout<<"Returning false from ShouldTaintObjectProperty"<<std::endl;
+  return false;
+}
+
+bool Isolate::IsObjectPropertySink(std::string object_name,
+                                   std::string property_name) {
+  // std::cout<<"Inside ShouldTaintObjectProperty"<<std::endl;
+
+  // std::cout<<"Object Name::"<<object_name<<std::endl;
+
+  if (!IsValidObjectProperty(object_name, property_name)) return false;
+
+  std::unordered_map<std::string, commons::Properties*> sink_database =
+      *sinks_database;
+
+  if (sink_database.find(object_name) == sink_database.end()) return false;
+
+  std::map<std::string, int>* t_included_properties =
+      sink_database[object_name]->included_properties;
+  std::map<std::string, int>* t_excluded_properties =
+      sink_database[object_name]->excluded_properties;
+
+  // taint every property of the object
+  if (t_included_properties == nullptr && t_excluded_properties == nullptr) {
+    return true;
+  }
+
+  // taint only the included properties
+  if (t_included_properties != nullptr && t_excluded_properties == nullptr) {
+    if (t_included_properties->find(property_name) !=
+        t_included_properties->end()) {
+      return true;
+    }
+  }
+
+  // taint if property is not excluded
+  if (t_included_properties == nullptr && t_excluded_properties != nullptr) {
+    if (t_excluded_properties->find(property_name) ==
+        t_excluded_properties->end()) {
+      return true;
+    }
+  }
+
+  // if both included and excluded are specified
+  if (t_included_properties != nullptr && t_excluded_properties != nullptr) {
+    std::cout << "\nBad Config";
+  }
+
+  // std::cout<<"Returning false from ShouldTaintObjectProperty"<<std::endl;
+  return false;
+}
+
+ParseInfo* Isolate::GetCompilationInfo(Handle<JSFunction> function) {
+  HandleScope scope(this);
+
+  Handle<SharedFunctionInfo> shared_info(function->shared(), this);
+
+  ParseInfo* info_;
+  commons::ParseInfoAndRCState* info_rc =
+      (commons::ParseInfoAndRCState*)ast_cache->get(
+          reinterpret_cast<void*>(shared_info->ptr()));
+
+  if (info_rc != NULL) {
+    info_ = (ParseInfo*)info_rc->parse_info;
+    if (info_ != NULL) return info_;
+  }
+
+  Handle<ScopeInfo> scope_info(shared_info->scope_info(), this);
+  Handle<Script> script(Script::cast(shared_info->script()), this);
+
+  MaybeHandle<ScopeInfo> maybe_outer_scope;
+
+  ReusableUnoptimizedCompileState* rk_reusable_compile_state_ =
+      new ReusableUnoptimizedCompileState(this);
+  UnoptimizedCompileState* rk_compile_state = new UnoptimizedCompileState();
+
+  UnoptimizedCompileFlags flags =
+      (scope_info->scope_type() == FUNCTION_SCOPE)
+          ? UnoptimizedCompileFlags::ForFunctionCompile(this, *shared_info)
+          : UnoptimizedCompileFlags::ForScriptCompile(this, *script)
+                .set_is_eager(true);
+
+  if (scope_info->scope_type() == EVAL_SCOPE) {
+    flags.set_is_eval(true);
+    if (!function->context().IsNativeContext()) {
+      maybe_outer_scope = handle(function->context().scope_info(), this);
+    }
+    flags.set_outer_language_mode(shared_info->language_mode());
+  } else if (scope_info->scope_type() == MODULE_SCOPE) {
+    DCHECK(script->origin_options().IsModule());
+    DCHECK(flags.is_module());
+  } else {
+    DCHECK(scope_info->scope_type() == SCRIPT_SCOPE ||
+           scope_info->scope_type() == FUNCTION_SCOPE);
+  }
+
+  info_ =
+      new ParseInfo(this, flags, rk_compile_state, rk_reusable_compile_state_);
+
+  const bool parse_result =
+      flags.is_toplevel()
+          ? parsing::ParseProgram(info_, script, maybe_outer_scope, this,
+                                  parsing::ReportStatisticsMode::kNo)
+          : parsing::ParseFunction(info_, shared_info, this,
+                                   parsing::ReportStatisticsMode::kNo);
+
+  if (!parse_result) {
+    delete rk_compile_state;
+    delete rk_reusable_compile_state_;
+    delete info_;
+    return NULL;
+  }
+
+#define AST_CACHE_LIMIT (1 << 10)
+
+  // std::cout<<info_->ptr();
+
+  if (ast_cache->size() == AST_CACHE_LIMIT) {
+    std::cout << "\n Cache size limit Exceeded" << std::flush;
+    //   // Eviction. For now we just get the first valid entry in
+    //   // the |ast_cache_| hash table.
+
+    // returns pointer to parseinfo
+    void* temp = ast_cache->removeAndReturnFirst();
+
+    commons::ParseInfoAndRCState* victim_info_rc =
+        (commons::ParseInfoAndRCState*)ast_cache->get(temp);
+
+    commons::HashTable* table = (commons::HashTable*)scope_dfg_cache->get(temp);
+
+    if (table != NULL) {
+      table->iterate(IterateScopeDFGDestructor, NULL);
+      delete table;
+      scope_dfg_cache->remove(temp);
+    }
+
+    table = (commons::HashTable*)located_scope_and_node_cache_->get(temp);
+    if (table != NULL) {
+      table->iterate(IterateScopeAndNodeDestructor, NULL);
+      delete table;
+      located_scope_and_node_cache_->remove(temp);
+    }
+
+    if (victim_info_rc != NULL) {
+      delete (ReusableUnoptimizedCompileState*)victim_info_rc->ruc_state;
+      ParseInfo* victim_info = (ParseInfo*)(victim_info_rc->parse_info);
+      delete victim_info->state();  // returns UnoptimizedCompileState
+      delete victim_info;
+      delete victim_info_rc;
+    }
+  }
+
+#undef AST_CACHE_LIMIT
+
+  commons::ParseInfoAndRCState* info_rc_new =
+      new commons::ParseInfoAndRCState(info_, rk_reusable_compile_state_);
+
+  ast_cache->insert(reinterpret_cast<void*>(shared_info->ptr()), info_rc_new);
+
+  return info_;
+}
+
+void Isolate::IterateScopeDFGDestructor(void* key, void* value, void* data) {
+  delete (ScopeDFG*)value;
+}
+
+void Isolate::IterateScopeAndNodeDestructor(void* key, void* value,
+                                            void* data) {
+  commons::HashTable* inner_table = (commons::HashTable*)value;
+  inner_table->iterate(IterateScopeAndNodeInnerDestructor, NULL);
+  delete inner_table;
+}
+
+void Isolate::IterateScopeAndNodeInnerDestructor(void* key, void* value,
+                                                 void* data) {
+  delete (ScopeAndNode*)value;
+}
+
+bool Isolate::inRKDebugMode() { return rk_debug; }
+
+void Isolate::setRKDebugMode(bool val) { rk_debug = val; }
+
+void Isolate::setNeedToPropagate(void* fp, bool val) {
+  if (val) {
+    need_to_propagate->insert(fp, NULL);
+  } else {
+    need_to_propagate->remove(fp);
+  }
+}
+
+bool Isolate::needToPropagate(void* fp) {
+  if (this->GetAstTaintTable(fp, false) == NULL) return false;
+
+  return need_to_propagate->search(fp);
+}
+
+bool Isolate::isTaintTable(Handle<Object> table) {
+  // #ifdef DEBUG
+  //   if (this->inRKDebugMode()) {
+  //     std::cout << "\n\nChecking if table is taint table :: " << std::hex
+  //               << table->ptr();
+  //   }
+  // #endif
+
+  return persistent_handles->ContainsPtr(table->ptr());
+}
+
+void Isolate::SetTaintForV8Object(Handle<Object> obj, std::string new_source) {
+  HandleScope scope(this);
+
+  // std::cout<<"\nSTFV8";
+
+  obj = FilterInvalidV8Objects(this, obj);
+  if (obj.is_null() || obj->IsSmi()) return;
+
+  // taintBusiness = true;
+
+  // if(taintBusiness) return;
+
+  std::string original_source = getObjectTaintSource(obj);
+  std::string final_source = original_source;
+
+  Handle<Object> str;
+
+#ifdef DEBUG
+  if (true) {
+    std::cout << "\n\n*Setting object taint for :: ";
+    if (!obj.is_null()) {
+      std::cout << obj->ptr() << " :: ";
+      // obj->Print();
+    } else
+      std::cout << "NULL Object\n";
+    std::cout << "Original Source :: " << original_source << std::flush;
+    std::cout << "\nDecoded Original :: " << decodeSource(original_source);
+    std::cout << "\nNew Source :: " << new_source << std::flush;
+    std::cout << "\nDecoded New :: " << decodeSource(new_source);
+  }
+#endif
+
+  if (original_source.empty() && !new_source.empty()) {
+    final_source = new_source;
+  }
+  // else if(!original_source.empty() && new_source.empty()){
+  //   final_source = original_source;
+  // }
+  else if (!original_source.empty() && !new_source.empty()) {
+    size_t start_bracket = new_source.find("[");
+    size_t end_bracket = new_source.find("]");
+
+    std::string id_str, new_sources;
+
+    while (start_bracket != std::string::npos) {
+      id_str =
+          new_source.substr(start_bracket, end_bracket - start_bracket + 1);
+
+      if (original_source.find(id_str) == std::string::npos) {
+        new_sources += id_str;
+      }
+
+      start_bracket = new_source.find("[", end_bracket + 1);
+      end_bracket = new_source.find("]", end_bracket + 1);
+    }
+
+    final_source = original_source + new_sources;
+    // if (original_source.find(new_source) == std::string::npos) {
+    //   final_source = original_source + new_source;
+    // }
+  }
+
+  str = factory()->NewStringFromAsciiChecked(final_source.c_str());
+
+// tables change if it gets rehashed or grows in size, we need to
+// check if the table has changed and if it has then we need to update
+// the persistent handle
+
+// if (true) {
+//   int num_ele = rk_taint_table->NumberOfElements();
+
+//   std::cout << "\nCurrent Size :: " << num_ele;
+// }
+#ifdef DEBUG
+  std::cout << "\nFinal Source :: " << final_source;
+#endif
+
+  Handle<EphemeronHashTable> temp_table =
+      EphemeronHashTable::Put(rk_taint_table, obj, str);
+
+  if (temp_table->ptr() != rk_taint_table->ptr()) {
+#ifdef DEBUG
+    if (this->inRKDebugMode()) {
+      std::cout << "\nTable changed";
+      std::cout << "\nOld table :: " << rk_taint_table->ptr();
+      std::cout << "\nNew table :: " << temp_table->ptr();
+    }
+#endif
+
+    persistent_handles->ReplacePtr(rk_taint_table->ptr(), temp_table->ptr());
+    maybeCollectGarbage();
+  }
+
+  // std::cout<<"\n STR PTR:: "<< str->ptr();
+  // Object m_obj = rk_taint_table->Lookup(obj);
+  // std::cout<<"\n MOBJ PTR:: "<< m_obj.ptr();
+}
+
+std::string Isolate::decodeSource(std::string encoded_source) {
+  size_t start_bracket = encoded_source.find("[");
+  size_t end_bracket = encoded_source.find("]");
+
+  int id;
+  std::string final_sources, decoded_name, id_str;
+
+  while (start_bracket != std::string::npos) {
+    id_str = encoded_source.substr(start_bracket + 1, end_bracket - 1);
+
+    id = std::stoi(id_str, nullptr, 16);
+
+    if (id == -1)
+      decoded_name = "JSON.stringify";
+    else
+      decoded_name = id_to_name_prop[id];
+
+    start_bracket = encoded_source.find("[", end_bracket + 1);
+    end_bracket = encoded_source.find("]", end_bracket + 1);
+
+    final_sources += (decoded_name + ",");
+  }
+
+  // remove last comma
+  if (final_sources.size() > 0) final_sources.pop_back();
+
+  return final_sources;
+}
+
+std::string Isolate::encodeNameAndProperty(std::string object_name,
+                                           std::string property_name) {
+  std::stringstream stream;
+
+  std::string result;
+
+  stream << "[";
+
+  if (name_prop_to_id.find(object_name + "." + property_name) !=
+      name_prop_to_id.end()) {
+    stream << std::hex << name_prop_to_id[object_name + "." + property_name];
+    stream << "]";
+
+    result = stream.str();
+
+    return result;
+  }
+
+  while (object_to_parent_map.find(object_name) != object_to_parent_map.end()) {
+    object_name = object_to_parent_map[object_name];
+    if (name_prop_to_id.find(object_name + "." + property_name) !=
+        name_prop_to_id.end()) {
+      stream << std::hex << name_prop_to_id[object_name + "." + property_name];
+      stream << "]";
+
+      result = stream.str();
+
+      return result;
+    }
+  }
+
+  return "";
+}
+
+std::string Isolate::getObjectTaintSource(Handle<Object> obj) {
+  obj = FilterInvalidV8Objects(this, obj);
+  if (obj.is_null() || obj->IsSmi()) return "";
+
+  // HandleScope scope(this);
+
+  Object temp = rk_taint_table->Lookup(obj);
+
+  if (temp != ReadOnlyRoots(this).the_hole_value()) {
+    return (String::cast(temp)).ToCString().get();
+  }
+
+  return "";
+}
+
+bool Isolate::IsV8ObjectTainted(Handle<Object> obj) {
+#ifdef DEBUG
+  if (this->inRKDebugMode()) {
+    std::cout << "\n\n*Inside IsV8ObjectTainted ";
+    std::cout << "\nChecking object taint for :: " << obj->ptr() << " :: ";
+    // obj->Print();
+    std::cout << "Source :: " << getObjectTaintSource(obj) << std::endl;
+  }
+#endif
+
+  // HandleScope scope(this);
+
+  obj = FilterInvalidV8Objects(this, obj);
+  if (obj.is_null()) return false;
+
+  if (rk_taint_table->Lookup(obj) != ReadOnlyRoots(this).the_hole_value()) {
+#ifdef DEBUG
+    if (this->inRKDebugMode())
+      std::cout << "Object Taint :: True" << std::flush;
+#endif
+
+    return true;
+  }
+
+#ifdef DEBUG
+  if (this->inRKDebugMode()) std::cout << "Object Taint :: False" << std::flush;
+#endif
+
+  return false;
+}
+
+void Isolate::DropAstTaintTable(void* fp) {
+  commons::HashTable* table = (commons::HashTable*)(ast_taint_table_.get(fp));
+  if (table != NULL) {
+    delete table;
+    ast_taint_table_.remove(fp);
+  }
+
+  this->setNeedToPropagate(fp, false);
+}
+
+bool Isolate::ShouldTaintBusiness() { return taintBusiness; }
+
+void Isolate::DropObjectMap(void* fp) {
+  Handle<SimpleNumberDictionary> per_function_ast_obj_map =
+      Handle<SimpleNumberDictionary>((Address*)rk_ast_obj_map->get(fp));
+
+  // iterate over per_function_ast_obj_map and delete each entry
+
+  // iterate over per_function_ast_obj_map and delete each entry
+  // for (int i = 0; i < per_function_ast_obj_map->number_of_entries(); i++) {
+  //   Object key = per_function_ast_obj_map->KeyAt(i);
+  //   Object value = per_function_ast_obj_map->ValueAt(i);
+  //   if (!value->IsUndefined()) {
+  //     per_function_ast_obj_map->DeleteProperty(key);
+  //   }
+  // }
+
+  if (!per_function_ast_obj_map.is_null()) {
+    // create a new empty simple number dictionary and replace the old one
+    HandleScope handle_scope(this);
+    Handle<SimpleNumberDictionary> temp_per_function_ast_obj_map =
+        SimpleNumberDictionary::New(this, 0);
+
+    persistent_handles->ReplacePtr(per_function_ast_obj_map->ptr(),
+                                   temp_per_function_ast_obj_map->ptr());
+
+    rk_ast_obj_map->remove(fp);
+
+    maybeCollectGarbage();
+  }
+}
+
+ScopeDFG* Isolate::GetScopeDFG(ParseInfo* info, long position) {
+  commons::HashTable* table = (commons::HashTable*)scope_dfg_cache->get(info);
+
+  if (table == NULL) {
+    table = new commons::HashTable();
+    scope_dfg_cache->insert(info, table);
+  }
+
+  ScopeDFG* dfg = (ScopeDFG*)table->get(reinterpret_cast<void*>(position));
+
+  if (dfg == NULL) {
+    ScopeLocator locator(this, info->scope(), int(position));
+
+    ZoneList<Statement*>* statements = info->literal()->body();
+    locator.Locate(statements);
+
+    // for (int i = 0; i < statements->length(); i++) {
+    //   Statement* stmt = statements->at(i);
+    //   stmt->Print(this);
+    // }
+
+    if (locator.found()) {
+      ScopeDFGBuilder builder(this, locator.LocatedScope(),
+                              locator.scope_dependencies(),
+                              locator.dependency_scopes());
+
+      // for (int i = 0; i < locator.LocatedScopeStatements()->length(); i++)
+      // {
+      //   Statement* stmt = locator.LocatedScopeStatements()->at(i);
+      //   stmt->Print(this);
+      // }
+
+      dfg = builder.Build(locator.LocatedScopeStatements());
+      CHECK(dfg != NULL);
+      table->insert(reinterpret_cast<void*>(position), dfg);
+    }
+  }
+
+  return dfg;
+}
+
+commons::HashTable* Isolate::GetAstTaintTable(void* fp, bool alloc) {
+  commons::HashTable* table = (commons::HashTable*)(ast_taint_table_.get(fp));
+  if (table == NULL && alloc) {
+    table = new commons::HashTable();
+    ast_taint_table_.insert(fp, table);
+  }
+  return table;
+}
+
+void Isolate::SetTaintForAstNode(Handle<JSFunction> function, void* fp,
+                                 int position, int type) {
+  CHECK(type == AstNode::kVariableProxy || type == AstNode::kProperty ||
+        type == AstNode::kCall);
+  // MakeASTPermanent(function);
+
+  commons::HashTable* table = GetAstTaintTable(fp, true);
+
+#ifdef DEBUG
+  if (true) {
+    std::cout << "\n\n*Inside SetTaintForAstNode";
+    std::cout << "\nTainting AST at location :: " << position << " type :: ";
+    if (type == AstNode::kVariableProxy) {
+      std::cout << "VariableProxy";
+    } else if (type == AstNode::kProperty) {
+      std::cout << "Property";
+    } else if (type == AstNode::kCall) {
+      std::cout << "Call";
+    } else {
+      std::cout << "Unknown";
+    }
+    std::cout << " (" << type << ") ";
+  }
+#endif
+
+  taintBusiness = true;
+
+  table->insert(KEY_FROM_POSITION_AND_TYPE(position, type), NULL);
+  this->setNeedToPropagate(fp, true);
+}
+
+bool Isolate::IsAstNodeTainted(void* fp, int position, int type) {
+  CHECK(type == AstNode::kVariableProxy || type == AstNode::kProperty ||
+        type == AstNode::kCall);
+
+  commons::HashTable* table = GetAstTaintTable(fp, false);
+
+  if (table == NULL) return false;
+
+  // std::cout << "\n\nTesting AST taint at location :: " << position
+  //           << " type ::" << type;
+
+  return table->search(KEY_FROM_POSITION_AND_TYPE(position, type));
+}
+
+void Isolate::AddToObjectMap(void* fp, int position, int type,
+                             Handle<Object> t_object) {
+  HandleScope scope(this);
+
+  // std::cout<<"\nATOM";
+
+  // bool m = true;
+  // if (m) return;
+
+  if (needToPropagate(fp) == false) return;
+
+#ifdef DEBUG
+  if (this->inRKDebugMode()) {
+    std::cout << "\n\n*Inside AddToObjectMap";
+    std::cout << "\nMapping " << position << " :: type ";
+    if (type == AstNode::kVariableProxy) {
+      std::cout << "VariableProxy";
+    } else if (type == AstNode::kProperty) {
+      std::cout << "Property";
+    } else if (type == AstNode::kCall) {
+      std::cout << "Call";
+    } else {
+      std::cout << "Unknown";
+    }
+    std::cout << " (" << type << ") ";
+    std::cout << " --- TO ---> ";
+    // t_object->Print();
+    std::cout << "PTR:: " << t_object->ptr() << std::endl << std::flush;
+  }
+#endif
+
+  t_object = FilterInvalidV8Objects(this, t_object);
+  if (t_object.is_null()) return;
+
+  int last4bytes_p_t = commons::HashTable::hash_pointer(
+      reinterpret_cast<void*>(KEY_FROM_POSITION_AND_TYPE(position, type)),
+      INT_MAX);
+
+  Handle<SimpleNumberDictionary> temp_per_function_ast_obj_map;
+
+  Handle<SimpleNumberDictionary> per_function_ast_obj_map =
+      Handle<SimpleNumberDictionary>((Address*)rk_ast_obj_map->get(fp));
+
+  // DisallowGarbageCollection no_gc;
+
+  if (per_function_ast_obj_map.is_null()) {
+    per_function_ast_obj_map =
+        persistent_handles->NewHandle(SimpleNumberDictionary::New(this, 100));
+
+    per_function_ast_obj_map = SimpleNumberDictionary::Add(
+        this, per_function_ast_obj_map, last4bytes_p_t, t_object,
+        PropertyDetails::Empty());
+
+    // we don't replace ptr since the per_function_ast_obj_map is just created
+    // and it won't change due to overflow
+  }
+
+  else {
+    temp_per_function_ast_obj_map = SimpleNumberDictionary::Add(
+        this, per_function_ast_obj_map, last4bytes_p_t, t_object,
+        PropertyDetails::Empty());
+
+    if (temp_per_function_ast_obj_map->ptr() !=
+        per_function_ast_obj_map->ptr()) {
+      persistent_handles->ReplacePtr(per_function_ast_obj_map->ptr(),
+                                     temp_per_function_ast_obj_map->ptr());
+      maybeCollectGarbage();
+    }
+  }
+  rk_ast_obj_map->insert(fp, per_function_ast_obj_map.location());
+}
+
+Object Isolate::LookupObjectMap(void* fp, int position, int type) {
+  int last4bytes_p_t = commons::HashTable::hash_pointer(
+      reinterpret_cast<void*>(KEY_FROM_POSITION_AND_TYPE(position, type)),
+      INT_MAX);
+
+  // v8::Isolate* isolate = v8::Isolate::GetCurrent();
+
+  // EscapableHandleScope handle_scope(isolate);
+
+#ifdef DEBUG
+  if (this->inRKDebugMode()) {
+    std::cout << "\n\n*Inside LookupObjectMap";
+    std::cout << "\nLooking up for ::  " << position << " :: type ";
+    if (type == AstNode::kVariableProxy) {
+      std::cout << "VariableProxy";
+    } else if (type == AstNode::kProperty) {
+      std::cout << "Property";
+    } else if (type == AstNode::kCall) {
+      std::cout << "Call";
+    } else {
+      std::cout << "Unknown";
+    }
+    std::cout << " (" << type << ") ";
+  }
+#endif
+
+  Handle<SimpleNumberDictionary> per_function_ast_obj_map =
+      Handle<SimpleNumberDictionary>((Address*)rk_ast_obj_map->get(fp));
+
+  if (per_function_ast_obj_map.is_null()) {
+#ifdef DEBUG
+    std::cout << "\nPer function AST Object Map is NULL";
+#endif
+    return ReadOnlyRoots(this).null_value();
+  }
+
+  InternalIndex obj_entry =
+      per_function_ast_obj_map->FindEntry(this, last4bytes_p_t);
+  if (obj_entry != InternalIndex(kNotFound)) {
+    // Object mapped_obj = per_function_ast_obj_map->ValueAt(obj_entry);
+
+    // #ifdef DEBUG
+    //     std::cout << "\nObject Found :: " << mapped_obj.ptr() << " :: ";
+    //     // mapped_obj.Print();
+    // #endif
+    return per_function_ast_obj_map->ValueAt(obj_entry);
+  }
+#ifdef DEBUG
+  std::cout << "\nObject Not Found";
+#endif
+  return ReadOnlyRoots(this).null_value();
+}
+
+void Isolate::UntaintAstNode(void* fp, int position, int type) {
+#ifdef DEBUG
+  std::cout << "\n\n*UntaintASTNODE::" << fp << " :: " << position
+            << " :: " << type;
+#endif
+
+  CHECK(type == AstNode::kVariableProxy || type == AstNode::kProperty ||
+        type == AstNode::kCall);
+  commons::HashTable* table = GetAstTaintTable(fp, false);
+  if (table == NULL) return;
+  table->remove(KEY_FROM_POSITION_AND_TYPE(position, type));
+  this->setNeedToPropagate(fp, true);
+  return;
+}
+
+void Isolate::AddLocatedScopeAndNode(ParseInfo* info, long type, long position,
+                                     ScopeAndNode* cached) {
+  commons::HashTable* table =
+      (commons::HashTable*)located_scope_and_node_cache_->get(info);
+  if (table == NULL) {
+    table = new commons::HashTable();
+    located_scope_and_node_cache_->insert(info, table);
+  }
+
+  commons::HashTable* inner_table =
+      (commons::HashTable*)table->get((void*)type);
+  if (inner_table == NULL) {
+    inner_table = new commons::HashTable();
+    table->insert((void*)type, inner_table);
+  }
+
+  inner_table->insert((void*)position, cached);
+}
+
+ScopeAndNode* Isolate::LocatedScopeAndNode(ParseInfo* info, long type,
+                                           long position) {
+  commons::HashTable* table =
+      (commons::HashTable*)located_scope_and_node_cache_->get(info);
+  if (table == NULL) return NULL;
+
+  commons::HashTable* inner_table =
+      (commons::HashTable*)table->get((void*)type);
+  if (inner_table == NULL) return NULL;
+
+  return (ScopeAndNode*)inner_table->get((void*)position);
+}
+
+//  :: End Taint Changes
+
 void Isolate::InitializeThreadLocal() {
   thread_local_top()->Initialize(this);
   clear_pending_exception();
@@ -5083,10 +6068,10 @@ void Isolate::UpdatePromiseHookProtector() {
 
 void Isolate::PromiseHookStateUpdated() {
   promise_hook_flags_ =
-    (promise_hook_flags_ & PromiseHookFields::HasContextPromiseHook::kMask) |
-    PromiseHookFields::HasIsolatePromiseHook::encode(promise_hook_) |
-    PromiseHookFields::HasAsyncEventDelegate::encode(async_event_delegate_) |
-    PromiseHookFields::IsDebugActive::encode(debug()->is_active());
+      (promise_hook_flags_ & PromiseHookFields::HasContextPromiseHook::kMask) |
+      PromiseHookFields::HasIsolatePromiseHook::encode(promise_hook_) |
+      PromiseHookFields::HasAsyncEventDelegate::encode(async_event_delegate_) |
+      PromiseHookFields::IsDebugActive::encode(debug()->is_active());
 
   if (promise_hook_flags_ != 0) {
     UpdatePromiseHookProtector();
@@ -5956,8 +6941,8 @@ void Isolate::AddCodeMemoryRange(MemoryRange range) {
 
 // |chunk| is either a Page or an executable LargePage.
 void Isolate::AddCodeMemoryChunk(MemoryChunk* chunk) {
-  // We only keep track of individual code pages/allocations if we are on arm32,
-  // because on x64 and arm64 we have a code range which makes this unnecessary.
+// We only keep track of individual code pages/allocations if we are on arm32,
+// because on x64 and arm64 we have a code range which makes this unnecessary.
 #if !defined(V8_TARGET_ARCH_ARM)
   return;
 #else
@@ -6043,8 +7028,8 @@ LocalHeap* Isolate::CurrentLocalHeap() {
 
 // |chunk| is either a Page or an executable LargePage.
 void Isolate::RemoveCodeMemoryChunk(MemoryChunk* chunk) {
-  // We only keep track of individual code pages/allocations if we are on arm32,
-  // because on x64 and arm64 we have a code range which makes this unnecessary.
+// We only keep track of individual code pages/allocations if we are on arm32,
+// because on x64 and arm64 we have a code range which makes this unnecessary.
 #if !defined(V8_TARGET_ARCH_ARM)
   return;
 #else
diff --git a/src/execution/isolate.h b/src/execution/isolate.h
index 8416faf..bca855e 100644
--- a/src/execution/isolate.h
+++ b/src/execution/isolate.h
@@ -10,6 +10,7 @@
 #include <functional>
 #include <memory>
 #include <queue>
+#include <sstream>
 #include <unordered_map>
 #include <vector>
 
@@ -23,6 +24,7 @@
 #include "src/base/platform/platform-posix.h"
 #include "src/builtins/builtins.h"
 #include "src/common/globals.h"
+#include "src/commons.h"
 #include "src/debug/interface-types.h"
 #include "src/execution/execution.h"
 #include "src/execution/futex-emulation.h"
@@ -42,6 +44,7 @@
 #include "src/objects/debug-objects.h"
 #include "src/objects/js-objects.h"
 #include "src/objects/tagged.h"
+#include "src/parsing/parse-info.h"
 #include "src/runtime/runtime.h"
 #include "src/sandbox/code-pointer-table.h"
 #include "src/sandbox/external-pointer-table.h"
@@ -553,6 +556,12 @@ using DebugObjectCache = std::vector<Handle<HeapObject>>;
 #define THREAD_LOCAL_TOP_ADDRESS(type, name) \
   inline type* name##_address() { return &thread_local_top()->name##_; }
 
+class UnoptimizedCompilationInfo;
+class AstNode;
+class Property;
+class ScopeDFG;
+struct ScopeAndNode;
+
 // HiddenFactory exists so Isolate can privately inherit from it without making
 // Factory's members available to Isolate directly.
 class V8_EXPORT_PRIVATE HiddenFactory : private Factory {};
@@ -1910,6 +1919,96 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
     elements_deletion_counter_ = value;
   }
 
+  //  :: Taint analysis stuff
+
+  ScopeDFG* GetScopeDFG(ParseInfo* info, long position);
+
+  bool ShouldTaintBusiness();
+
+  // ParseInfo* GetCompilationInfo(Handle<JSFunction> function);
+
+  ParseInfo* GetCompilationInfo(Handle<JSFunction> function);
+
+  void InitTables();
+
+  void SetTaintForV8Object(Handle<Object> obj, std::string source = "");
+
+// max_objs = 1052
+// max_props = 569
+// null terminator = 8
+// total size = 1052 + 569 + 8 = 1629
+// added 3 for padding
+#define MAX_TAINT_BITSET_SIZE 1632
+
+  // void AddPropagatedFrom(Handle<Object> obj, Handle<Object> source);
+
+  bool isTaintTable(Handle<Object> table);
+
+  // Math.cos()
+  bool isMethod(std::string obj_name, std::string method_name);
+
+  // Math.PI
+  bool isProperty(std::string obj_name, std::string prop_name);
+
+  bool inRKDebugMode();
+
+  void setRKDebugMode(bool val);
+
+  void setNeedToPropagate(void* fp, bool val);
+
+  bool needToPropagate(void* fp);
+
+  static void IterateScopeDFGDestructor(void* key, void* value, void* data);
+
+  static void IterateScopeAndNodeDestructor(void* key, void* value, void* data);
+  static void IterateScopeAndNodeInnerDestructor(void* key, void* value,
+                                                 void* data);
+
+  bool IsV8ObjectTainted(Handle<Object> obj);
+
+  void AddLocatedScopeAndNode(ParseInfo* info, long type, long position,
+                              ScopeAndNode* cached);
+
+  ScopeAndNode* LocatedScopeAndNode(ParseInfo* info, long type, long position);
+
+  commons::HashTable* GetAstTaintTable(void* fp, bool alloc);
+
+  void SetTaintForAstNode(Handle<JSFunction> function, void* fp, int position,
+                          int type);
+
+  bool IsAstNodeTainted(void* fp, int position, int type);
+
+  void UntaintAstNode(void* fp, int position, int type);
+
+  void AddToObjectMap(void* fp, int position, int type, Handle<Object> object);
+
+  Object LookupObjectMap(void* fp, int position, int type);
+
+  void DropAstTaintTable(void* fp);
+  void DropObjectMap(void* fp);
+
+  bool IsValidObjectProperty(std::string object_name,
+                             std::string property_name);
+
+  bool IsObjectPropertySource(std::string object_name,
+                              std::string property_name);
+  bool IsObjectPropertySink(std::string object_name, std::string property_name);
+
+  std::string getObjectTaintSource(Handle<Object> obj);
+
+  std::string encodeNameAndProperty(std::string object_name,
+                                    std::string property_name);
+
+  std::string decodeSource(std::string source);
+
+  void loadDatabase(
+      std::unordered_map<std::string, commons::Properties*>* database,
+      std::string file_name);
+
+  void parseIDL(std::string file_name);
+
+  // End Taint analysis stuff
+
 #if V8_ENABLE_WEBASSEMBLY
   void AddSharedWasmMemory(Handle<WasmMemoryObject> memory_object);
 #endif  // V8_ENABLE_WEBASSEMBLY
@@ -2506,6 +2605,65 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   friend class GlobalSafepoint;
   friend class TestSerializer;
   friend class SharedHeapNoClientsTest;
+
+  //  :: Added persistent handles and taint table
+  std::unique_ptr<PersistentHandles> persistent_handles;
+
+  Handle<EphemeronHashTable> rk_taint_table;
+
+  //  commons::HashTable ptr_tables_table;
+
+  bool rk_debug = true;
+
+  Handle<EphemeronHashTable> tainted_functions;
+  Handle<SimpleNumberDictionary> ast_obj_map;
+  // Handle<GlobalDictionary> rk_dictionary;
+
+  // ReusableUnoptimizedCompileState* reusable_compile_state_;
+
+  UnoptimizedCompileState compile_state;
+
+  commons::HashTable ast_taint_table_;
+  // commons::HashTable object_map_;
+  // commons::HashTable non_heap_keys_;
+
+  commons::HashTable* scope_dfg_cache;
+  commons::HashTable* permanent_ast_cache;
+  commons::HashTable* ast_cache;
+  commons::HashTable* rk_ast_obj_map;
+  commons::HashTable* located_scope_and_node_cache_;
+  commons::HashTable* need_to_propagate;
+
+  int max_objs, max_props;
+  const int idl_max_objs = 1052;
+  const int idl_max_props = 569;
+
+  int garbage_collection_requests_;
+
+  void maybeCollectGarbage();
+
+  std::unordered_map<std::string, commons::Properties*>* sources_database =
+      new std::unordered_map<std::string, commons::Properties*>();
+  std::unordered_map<std::string, commons::Properties*>* sinks_database =
+      new std::unordered_map<std::string, commons::Properties*>();
+
+  std::unordered_map<std::string, commons::Properties*>* idl_database =
+      new std::unordered_map<std::string, commons::Properties*>();
+
+  // std::vector<std::string> obj_name_array;
+
+  std::vector<std::string> id_to_name_prop;
+
+  std::unordered_map<std::string, int> name_prop_to_id;
+
+  std::unordered_map<std::string, std::string> object_to_parent_map;
+
+  std::unordered_set<std::string>* methods_database =
+      new std::unordered_set<std::string>();
+  std::unordered_set<std::string>* properties_database =
+      new std::unordered_set<std::string>();
+
+  bool taintBusiness = true;
 };
 
 // The current entered Isolate and its thread data. Do not access these
diff --git a/src/handles/persistent-handles.cc b/src/handles/persistent-handles.cc
index ac2db08..f503b75 100644
--- a/src/handles/persistent-handles.cc
+++ b/src/handles/persistent-handles.cc
@@ -23,6 +23,7 @@ PersistentHandles::PersistentHandles(Isolate* isolate)
 
 PersistentHandles::~PersistentHandles() {
   isolate_->persistent_handles_list()->Remove(this);
+  ptrs_.clear();
 
   for (Address* block_start : blocks_) {
 #if ENABLE_HANDLE_ZAPPING
@@ -75,6 +76,52 @@ void PersistentHandles::AddBlock() {
 #endif
 }
 
+// Added contains ptr, replace ptr and remove
+bool PersistentHandles::ContainsPtr(Address loc) {
+  // std::cout << "\n\nPTL::ContainsPtr" << loc << std::endl;
+
+  if (ptrs_.find(loc) != ptrs_.end()) return true;
+
+  return false;
+}
+
+void PersistentHandles::ReplacePtr(Address original, Address new_addr) {
+  // std::cout << "\n\nPTL::ContainsPtr" << loc << std::endl;
+
+  // search if ptr unordered set contains loc
+
+  if (ptrs_.find(original) == ptrs_.end()) return;
+
+  ptrs_.erase(original);
+  ptrs_.insert(new_addr);
+
+  for (int i = 0; i < static_cast<int>(blocks_.size()) - 1; i++) {
+    Address* block_start = blocks_[i];
+    Address* block_end = block_start + kHandleBlockSize;
+
+    for (Address* address = block_start; address < block_end; address++) {
+      if (*address == original) {
+        *address = new_addr;
+        return;
+      }
+    }
+  }
+
+  if (!blocks_.empty()) {
+    Address* block_start = blocks_.back();
+
+    for (Address* address = block_start; address < block_next_; address++) {
+      if (*address == original) {
+        *address = new_addr;
+        return;
+      }
+    }
+  }
+
+  // return false;
+}
+
+
 Address* PersistentHandles::GetHandle(Address value) {
   if (block_next_ == block_limit_) {
     AddBlock();
@@ -82,6 +129,7 @@ Address* PersistentHandles::GetHandle(Address value) {
 
   DCHECK_LT(block_next_, block_limit_);
   *block_next_ = value;
+  ptrs_.insert(value);
   return block_next_++;
 }
 
diff --git a/src/handles/persistent-handles.h b/src/handles/persistent-handles.h
index aa5d0c6..ee30d49 100644
--- a/src/handles/persistent-handles.h
+++ b/src/handles/persistent-handles.h
@@ -13,6 +13,7 @@
 #include "src/execution/isolate.h"
 #include "src/objects/visitors.h"
 #include "testing/gtest/include/gtest/gtest_prod.h"  // nogncheck
+#include "src/commons.h"
 
 namespace v8 {
 namespace internal {
@@ -30,7 +31,11 @@ class PersistentHandles {
   PersistentHandles(const PersistentHandles&) = delete;
   PersistentHandles& operator=(const PersistentHandles&) = delete;
 
-  V8_EXPORT_PRIVATE void Iterate(RootVisitor* visitor);
+//   :: added iterate and replace ptr
+ V8_EXPORT_PRIVATE void Iterate(RootVisitor* visitor);
+  bool ContainsPtr(Address loc);
+
+  void ReplacePtr(Address original, Address source);
 
   template <typename T>
   Handle<T> NewHandle(Tagged<T> obj) {
@@ -79,6 +84,8 @@ class PersistentHandles {
   Address* block_next_;
   Address* block_limit_;
 
+ std::unordered_set<Address> ptrs_;
+
   PersistentHandles* prev_;
   PersistentHandles* next_;
 
diff --git a/src/heap/factory-base.cc b/src/heap/factory-base.cc
index 793e0b2..9e98da6 100644
--- a/src/heap/factory-base.cc
+++ b/src/heap/factory-base.cc
@@ -893,12 +893,30 @@ Handle<String> FactoryBase<Impl>::NewConsString(Handle<String> left,
 template <typename Impl>
 Handle<String> FactoryBase<Impl>::LookupSingleCharacterStringFromCode(
     uint16_t code) {
+
   if (code <= unibrow::Latin1::kMaxChar) {
-    DisallowGarbageCollection no_gc;
-    Object value = single_character_string_table()->get(code);
-    DCHECK_NE(value, *undefined_value());
-    return handle(String::cast(value), isolate());
+    Handle<SeqOneByteString> result =
+        NewRawOneByteString(1, AllocationType::kOld).ToHandleChecked();
+  DisallowGarbageCollection no_gc;
+  // Copy the characters into the new object.
+  // SharedStringAccessGuardIfNeeded is NotNeeded because {result} is freshly
+  // allocated and hasn't escaped the factory yet, so it can't be concurrently
+  // accessed.
+      // uint16_t* temp = &code;
+  CopyChars(SeqOneByteString::cast(*result).GetChars(
+                no_gc, SharedStringAccessGuardIfNeeded::NotNeeded()),
+            &code, 1);
+  return result;
+
   }
+
+
+  // if (code <= unibrow::Latin1::kMaxChar) {
+  //   DisallowGarbageCollection no_gc;
+  //   Object value = single_character_string_table()->get(code);
+  //   DCHECK_NE(value, *undefined_value());
+  //   return handle(String::cast(value), isolate());
+  // }
   uint16_t buffer[] = {code};
   return InternalizeString(base::Vector<const uint16_t>(buffer, 1));
 }
@@ -909,7 +927,7 @@ MaybeHandle<String> FactoryBase<Impl>::NewStringFromOneByte(
   DCHECK_NE(allocation, AllocationType::kReadOnly);
   int length = string.length();
   if (length == 0) return empty_string();
-  if (length == 1) return LookupSingleCharacterStringFromCode(string[0]);
+  // if (length == 1) return LookupSingleCharacterStringFromCode(string[0]);
   Handle<SeqOneByteString> result;
   ASSIGN_RETURN_ON_EXCEPTION(isolate(), result,
                              NewRawOneByteString(string.length(), allocation),
diff --git a/src/init/bootstrapper.cc b/src/init/bootstrapper.cc
index e0cb548..69ddb07 100644
--- a/src/init/bootstrapper.cc
+++ b/src/init/bootstrapper.cc
@@ -6854,6 +6854,7 @@ Genesis::Genesis(
 
   native_context()->ResetErrorsThrown();
   result_ = native_context();
+  isolate->InitTables();
 }
 
 Genesis::Genesis(Isolate* isolate,
diff --git a/src/init/v8.cc b/src/init/v8.cc
index 71b811a..82179e7 100644
--- a/src/init/v8.cc
+++ b/src/init/v8.cc
@@ -279,6 +279,9 @@ void V8::Initialize() {
 
   ExternalReferenceTable::InitializeOncePerProcess();
 
+  extern void visv8_tls_init();
+  visv8_tls_init();
+
   AdvanceStartupState(V8StartupState::kV8Initialized);
 }
 
diff --git a/src/interpreter/bytecode-generator.cc b/src/interpreter/bytecode-generator.cc
index bd6c010..94c1594 100644
--- a/src/interpreter/bytecode-generator.cc
+++ b/src/interpreter/bytecode-generator.cc
@@ -1561,6 +1561,13 @@ void BytecodeGenerator::GenerateBytecodeBody() {
     }
   }
 
+  RegisterAllocationScope register_scope(this);
+  Register backup_reg = register_allocator()->NewRegister();
+
+  builder()->StoreAccumulatorInRegister(backup_reg);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnFunctionEnter, backup_reg);
+
   // Visit statements in the function body.
   VisitStatements(literal->body());
 
@@ -1707,7 +1714,8 @@ void BytecodeGenerator::VisitFunctionDeclaration(FunctionDeclaration* decl) {
     case VariableLocation::PARAMETER:
     case VariableLocation::LOCAL: {
       VisitFunctionLiteral(decl->fun());
-      BuildVariableAssignment(variable, Token::INIT, HoleCheckMode::kElided);
+      // BuildVariableAssignment(variable, Token::INIT, HoleCheckMode::kElided);
+      BuildVariableAssignment(decl->var(), Token::INIT, HoleCheckMode::kElided);
       break;
     }
     case VariableLocation::REPL_GLOBAL:
@@ -1905,6 +1913,27 @@ void BytecodeGenerator::VisitReturnStatement(ReturnStatement* stmt) {
   AllocateBlockCoverageSlotIfEnabled(stmt, SourceRangeKind::kContinuation);
   builder()->SetStatementPosition(stmt);
   VisitForAccumulatorValue(stmt->expression());
+  //  :: Visit Return Statement
+
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(2);
+
+  // contains the object that was loaded into accumulator
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  // contains position of the expression
+  builder()
+      ->LoadLiteral(Smi::FromInt(stmt->position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  // we also modify the smi value of the original object :: returned in the
+  // accumulator
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitReturnStatement,
+                         runtime_call_args);
+
+  //  :: end changes
+
   int return_position = stmt->end_position();
   if (return_position == ReturnStatement::kFunctionLiteralReturnPosition) {
     return_position = info()->literal()->return_position();
@@ -1921,6 +1950,23 @@ void BytecodeGenerator::VisitWithStatement(WithStatement* stmt) {
   VisitForAccumulatorValue(stmt->expression());
   BuildNewLocalWithContext(stmt->scope());
   VisitInScope(stmt->statement(), stmt->scope());
+
+  //  :: On scope exit :: we only propagate taint on exit
+
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(2);
+
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  builder()
+      ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnScopeExit,
+                         runtime_call_args);
+
+  //  :: changes end
 }
 
 namespace {
@@ -2698,6 +2744,24 @@ void BytecodeGenerator::VisitTryCatchStatement(TryCatchStatement* stmt) {
         }
       },
       catch_prediction(), stmt);
+
+  //  :: On scope exit :: might fail please check the position of
+  // runtime call
+
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(2);
+
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  builder()
+      ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnScopeExit,
+                         runtime_call_args);
+
+  //  :: changes end
 }
 
 void BytecodeGenerator::VisitTryFinallyStatement(TryFinallyStatement* stmt) {
@@ -3394,21 +3458,21 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
     }
   }
 
-    // Define accessors, using only a single call to the runtime for each pair
-    // of corresponding getters and setters.
-    object_literal_context_scope.SetEnteredIf(true);
-    for (auto accessors : accessor_table.ordered_accessors()) {
-      RegisterAllocationScope inner_register_scope(this);
-      RegisterList args = register_allocator()->NewRegisterList(5);
-      builder()->MoveRegister(literal, args[0]);
-      VisitForRegisterValue(accessors.first, args[1]);
-      VisitLiteralAccessor(accessors.second->getter, args[2]);
-      VisitLiteralAccessor(accessors.second->setter, args[3]);
-      builder()
-          ->LoadLiteral(Smi::FromInt(NONE))
-          .StoreAccumulatorInRegister(args[4])
-          .CallRuntime(Runtime::kDefineAccessorPropertyUnchecked, args);
-    }
+  // Define accessors, using only a single call to the runtime for each pair
+  // of corresponding getters and setters.
+  object_literal_context_scope.SetEnteredIf(true);
+  for (auto accessors : accessor_table.ordered_accessors()) {
+    RegisterAllocationScope inner_register_scope(this);
+    RegisterList args = register_allocator()->NewRegisterList(5);
+    builder()->MoveRegister(literal, args[0]);
+    VisitForRegisterValue(accessors.first, args[1]);
+    VisitLiteralAccessor(accessors.second->getter, args[2]);
+    VisitLiteralAccessor(accessors.second->setter, args[3]);
+    builder()
+        ->LoadLiteral(Smi::FromInt(NONE))
+        .StoreAccumulatorInRegister(args[4])
+        .CallRuntime(Runtime::kDefineAccessorPropertyUnchecked, args);
+  }
 
   // Object literals have two parts. The "static" part on the left contains no
   // computed property names, and so we can compute its map ahead of time; see
@@ -3532,6 +3596,28 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
   // accumulator, to prevent the context scope from clobbering it.
   object_literal_context_scope.SetEnteredIf(false);
   builder()->LoadAccumulatorWithRegister(literal);
+
+//  :: changes for objectliteral
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args_fast =
+      register_allocator()->NewRegisterList(3);
+
+  // contains the final object literal
+  builder()->StoreAccumulatorInRegister(runtime_call_args_fast[0]);
+
+  // // contains starting location of the current scope :: not required
+  builder()
+      ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+      .StoreAccumulatorInRegister(runtime_call_args_fast[1]);
+
+  // // contains the location of proxy (in AST)
+  builder()
+      ->LoadLiteral(Smi::FromInt(expr->position()))
+      .StoreAccumulatorInRegister(runtime_call_args_fast[2]);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitObjectLiteralFast,
+                         runtime_call_args_fast);
 }
 
 // Fill an array with values from an iterator, starting at a given index. It is
@@ -3743,11 +3829,39 @@ void BytecodeGenerator::BuildCreateArrayLiteral(
 void BytecodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
   expr->builder()->InitDepthAndFlags();
   BuildCreateArrayLiteral(expr->values(), expr);
+
+  //  :: the generated array is in the accumulator
+
+  //  :: OnvisitArrayLiteral
+
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(3);
+
+  // contains the object that was loaded into accumulator
+
+  // the final built array
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  // contains starting location of the current scope :: not required
+  builder()
+      ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  // contains the location of proxy (in AST)
+  builder()
+      ->LoadLiteral(Smi::FromInt(expr->position()))
+      .StoreAccumulatorInRegister(runtime_call_args[2]);
+
+  // index of the property in the object
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitArrayLiteral,
+                         runtime_call_args);
 }
 
 void BytecodeGenerator::VisitVariableProxy(VariableProxy* proxy) {
   builder()->SetExpressionPosition(proxy);
-  BuildVariableLoad(proxy->var(), proxy->hole_check_mode());
+  BuildVariableLoad(proxy, proxy->hole_check_mode());
 }
 
 bool BytecodeGenerator::IsVariableInRegister(Variable* var, Register reg) {
@@ -3894,13 +4008,72 @@ void BytecodeGenerator::BuildVariableLoad(Variable* variable,
   }
 }
 
+//  :: Variable Proxy instead of Variable (because proxy has a
+// location, variable does not)
+void BytecodeGenerator::BuildVariableLoad(VariableProxy* proxy,
+                                          HoleCheckMode hole_check_mode,
+                                          TypeofMode typeof_mode) {
+  // BuildVariableLoad loads the object denoted by a variable example ::
+  // Math.cos(c) we load the object denoted by the variable proxy c
+  // We don't modify SMIs, it will be modified when we set the value //
+  // onbuildvariableassignment
+
+  // defer the call to original builder
+  BuildVariableLoad(proxy->var(), hole_check_mode, typeof_mode);
+
+  // the value gets loaded in the accumulator after the call above
+
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(2);
+
+  // contains the object that was loaded into accumulator
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  // contains the location of proxy (in AST)
+  builder()
+      ->LoadLiteral(Smi::FromInt(proxy->position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnBuildVariableLoad,
+                         runtime_call_args);
+
+  // changes above might have clobbered the accumulator
+  // builder()->LoadAccumulatorWithRegister(runtime_call_args.first_register());
+}
+
 void BytecodeGenerator::BuildVariableLoadForAccumulatorValue(
     Variable* variable, HoleCheckMode hole_check_mode, TypeofMode typeof_mode) {
   ValueResultScope accumulator_result(this);
   BuildVariableLoad(variable, hole_check_mode, typeof_mode);
 }
 
+void BytecodeGenerator::BuildVariableLoadForAccumulatorValue(
+    VariableProxy* proxy, HoleCheckMode hole_check_mode,
+    TypeofMode typeof_mode) {
+  ValueResultScope accumulator_result(this);
+  BuildVariableLoad(proxy, hole_check_mode, typeof_mode);
+}
+
 void BytecodeGenerator::BuildReturn(int source_position) {
+  //  :: On scope exit
+  // Visit return might miss the case in which the function does not return any
+  // value
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(2);
+
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  builder()
+      ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnFunctionExit,
+                         runtime_call_args);
+
+  //  :: changes end
+
   if (v8_flags.trace) {
     RegisterAllocationScope register_scope(this);
     Register result = register_allocator()->NewRegister();
@@ -4157,6 +4330,33 @@ void BytecodeGenerator::BuildVariableAssignment(
   }
 }
 
+//  :: Custom Variable assignment to use proxy instead of variable
+void BytecodeGenerator::BuildVariableAssignment(
+    VariableProxy* proxy, Token::Value op, HoleCheckMode hole_check_mode,
+    LookupHoistingMode lookup_hoisting_mode) {
+  //     // We also replace the accumulator if it is smi
+
+  // in case of assignment, the value to be assigned is already in the
+  // accumulator
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(2);
+
+  // contains the object that was loaded into accumulator
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  // contains the location of proxy (in AST)
+  builder()
+      ->LoadLiteral(Smi::FromInt(proxy->position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnBuildVariableAssignment,
+                         runtime_call_args);
+
+  BuildVariableAssignment(proxy->var(), op, hole_check_mode,
+                          lookup_hoisting_mode);
+}
+
 void BytecodeGenerator::BuildLoadNamedProperty(const Expression* object_expr,
                                                Register object,
                                                const AstRawString* name) {
@@ -4296,7 +4496,7 @@ BytecodeGenerator::AssignmentLhsData BytecodeGenerator::PrepareAssignmentLhs(
       BuildThisVariableLoad();
       builder()->StoreAccumulatorInRegister(super_property_args[0]);
       BuildVariableLoad(
-          property->obj()->AsSuperPropertyReference()->home_object()->var(),
+          property->obj()->AsSuperPropertyReference()->home_object(),
           HoleCheckMode::kElided);
       builder()->StoreAccumulatorInRegister(super_property_args[1]);
       builder()
@@ -4311,7 +4511,7 @@ BytecodeGenerator::AssignmentLhsData BytecodeGenerator::PrepareAssignmentLhs(
       BuildThisVariableLoad();
       builder()->StoreAccumulatorInRegister(super_property_args[0]);
       BuildVariableLoad(
-          property->obj()->AsSuperPropertyReference()->home_object()->var(),
+          property->obj()->AsSuperPropertyReference()->home_object(),
           HoleCheckMode::kElided);
       builder()->StoreAccumulatorInRegister(super_property_args[1]);
       VisitForRegisterValue(property->key(), super_property_args[2]);
@@ -4802,7 +5002,7 @@ void BytecodeGenerator::BuildAssignment(
       } else {
         DCHECK(lhs_data.expr()->IsVariableProxy());
         VariableProxy* proxy = lhs_data.expr()->AsVariableProxy();
-        BuildVariableAssignment(proxy->var(), op, proxy->hole_check_mode(),
+        BuildVariableAssignment(proxy, op, proxy->hole_check_mode(),
                                 lookup_hoisting_mode);
       }
       break;
@@ -4883,6 +5083,27 @@ void BytecodeGenerator::VisitAssignment(Assignment* expr) {
 
   VisitForAccumulatorValue(expr->value());
 
+  //  :: Changes begin
+
+  RegisterAllocationScope register_scope(this);
+
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(3);
+
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  builder()
+      ->LoadLiteral(Smi::FromInt(expr->target()->position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  builder()
+      ->LoadLiteral(Smi::FromInt(expr->position()))
+      .StoreAccumulatorInRegister(runtime_call_args[2]);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitAssignment,
+                         runtime_call_args);
+
+  //  :: Changes end
+
   builder()->SetExpressionPosition(expr);
   BuildAssignment(lhs_data, expr->op(), expr->lookup_hoisting_mode());
 }
@@ -4895,7 +5116,7 @@ void BytecodeGenerator::VisitCompoundAssignment(CompoundAssignment* expr) {
   switch (lhs_data.assign_type()) {
     case NON_PROPERTY: {
       VariableProxy* proxy = expr->target()->AsVariableProxy();
-      BuildVariableLoad(proxy->var(), proxy->hole_check_mode());
+      BuildVariableLoad(proxy, proxy->hole_check_mode());
       break;
     }
     case NAMED_PROPERTY: {
@@ -5428,18 +5649,111 @@ void BytecodeGenerator::VisitPropertyLoad(Register obj, Property* property) {
       const AstRawString* name =
           property->key()->AsLiteral()->AsRawPropertyName();
       BuildLoadNamedProperty(property->obj(), obj, name);
+
+      //  :: Maybe possible better changes :: We replace Smi as well
+      RegisterAllocationScope register_scope(this);
+
+      RegisterList runtime_call_args = register_allocator()->NewRegisterList(4);
+
+      // Accumulator currently contains the final object (ex. string in
+      // document.URL)
+      builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+      // Expression position in AST
+      builder()
+          ->LoadLiteral(Smi::FromInt(property->position()))
+          .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+      // Contains the object for which the property is requested (ex. document
+      // in document.URL)
+      builder()->LoadAccumulatorWithRegister(obj).StoreAccumulatorInRegister(
+          runtime_call_args[2]);
+
+      // Contains the name of property that is requested (ex. URL in
+      // document.URL)
+      builder()->LoadLiteral(name).StoreAccumulatorInRegister(
+          runtime_call_args[3]);
+
+      builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitNamedPropertyLoad,
+                             runtime_call_args);
+
       break;
     }
     case KEYED_PROPERTY: {
       VisitForAccumulatorValue(property->key());
+
+      Register key_reg = VisitForRegisterValue(property->key());
+      RegisterAllocationScope register_scope(this);
+
+      RegisterList runtime_call_args = register_allocator()->NewRegisterList(3);
+
       builder()->SetExpressionPosition(property);
+
+      builder()->LoadAccumulatorWithRegister(key_reg);
+
       builder()->LoadKeyedProperty(
           obj, feedback_index(feedback_spec()->AddKeyedLoadICSlot()));
+
+      // // Accumulator currently contains the final object (ex. the returned
+      // string in
+      // // document.URL)
+      builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+      // // Expression position in AST
+      builder()
+          ->LoadLiteral(Smi::FromInt(property->position()))
+          .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+      // // Contains the object for which the property is requested (ex.
+      // obj in obj[10])
+      builder()->LoadAccumulatorWithRegister(obj).StoreAccumulatorInRegister(
+          runtime_call_args[2]);
+
+      builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitKeyedPropertyLoad,
+                             runtime_call_args);
+
       break;
     }
-    case NAMED_SUPER_PROPERTY:
+    case NAMED_SUPER_PROPERTY: {
       VisitNamedSuperPropertyLoad(property, Register::invalid_value());
+
+      const AstRawString* name2 =
+          property->key()->AsLiteral()->AsRawPropertyName();
+
+      // BuildLoadNamedProperty(property->obj(), obj, name);
+
+      //  :: Maybe possible better changes :: We replace Smi as well
+
+      RegisterAllocationScope register_scope(this);
+
+      // Register obj = VisitForRegisterValue(property->obj());
+
+      RegisterList runtime_call_args = register_allocator()->NewRegisterList(4);
+      // Accumulator currently contains the final object (ex. the returned
+      // string in document.URL)
+      builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+      // Expression position in AST
+      builder()
+          ->LoadLiteral(Smi::FromInt(property->position()))
+          .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+      // Contains the object for which the property is requested (ex. document
+      // in document.URL)
+      builder()
+          ->LoadAccumulatorWithRegister(VisitForRegisterValue(property->obj()))
+          .StoreAccumulatorInRegister(runtime_call_args[2]);
+
+      // Contains the name of property that is requested (ex. URL in
+      // document.URL)
+      builder()->LoadLiteral(name2).StoreAccumulatorInRegister(
+          runtime_call_args[3]);
+
+      builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitNamedPropertyLoad,
+                             runtime_call_args);
+
       break;
+    }
     case KEYED_SUPER_PROPERTY:
       VisitKeyedSuperPropertyLoad(property, Register::invalid_value());
       break;
@@ -5659,7 +5973,7 @@ void BytecodeGenerator::VisitNamedSuperPropertyLoad(Property* property,
     BuildThisVariableLoad();
     builder()->StoreAccumulatorInRegister(receiver);
     BuildVariableLoad(
-        property->obj()->AsSuperPropertyReference()->home_object()->var(),
+        property->obj()->AsSuperPropertyReference()->home_object(),
         HoleCheckMode::kElided);
     builder()->SetExpressionPosition(property);
     auto name = property->key()->AsLiteral()->AsRawPropertyName();
@@ -5673,7 +5987,7 @@ void BytecodeGenerator::VisitNamedSuperPropertyLoad(Property* property,
     BuildThisVariableLoad();
     builder()->StoreAccumulatorInRegister(args[0]);
     BuildVariableLoad(
-        property->obj()->AsSuperPropertyReference()->home_object()->var(),
+        property->obj()->AsSuperPropertyReference()->home_object(),
         HoleCheckMode::kElided);
     builder()->StoreAccumulatorInRegister(args[1]);
     builder()->SetExpressionPosition(property);
@@ -5692,17 +6006,37 @@ void BytecodeGenerator::VisitKeyedSuperPropertyLoad(Property* property,
                                                     Register opt_receiver_out) {
   RegisterAllocationScope register_scope(this);
   RegisterList args = register_allocator()->NewRegisterList(3);
+  RegisterList runtime_call_args = register_allocator()->NewRegisterList(3);
   BuildThisVariableLoad();
   builder()->StoreAccumulatorInRegister(args[0]);
-  BuildVariableLoad(
-      property->obj()->AsSuperPropertyReference()->home_object()->var(),
-      HoleCheckMode::kElided);
+  BuildVariableLoad(property->obj()->AsSuperPropertyReference()->home_object(),
+                    HoleCheckMode::kElided);
   builder()->StoreAccumulatorInRegister(args[1]);
   VisitForRegisterValue(property->key(), args[2]);
 
   builder()->SetExpressionPosition(property);
   builder()->CallRuntime(Runtime::kLoadKeyedFromSuper, args);
 
+  //  :: Patches for Keyed Value Load
+
+  // super["key"] :: super is the obj
+
+  // The returned value
+  builder()->StoreAccumulatorInRegister(runtime_call_args[0]);
+
+  // // Expression position in AST
+  builder()
+      ->LoadLiteral(Smi::FromInt(property->position()))
+      .StoreAccumulatorInRegister(runtime_call_args[1]);
+
+  // // Contains the object for which the property is requested (ex.
+  // obj in obj[10])
+  builder()->LoadAccumulatorWithRegister(args[1]).StoreAccumulatorInRegister(
+      runtime_call_args[2]);
+
+  builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitKeyedPropertyLoad,
+                         runtime_call_args);
+
   if (opt_receiver_out.is_valid()) {
     builder()->MoveRegister(args[0], opt_receiver_out);
   }
@@ -5804,8 +6138,7 @@ void BytecodeGenerator::VisitCall(Call* expr) {
       }
       // Load callee as a global variable.
       VariableProxy* proxy = callee_expr->AsVariableProxy();
-      BuildVariableLoadForAccumulatorValue(proxy->var(),
-                                           proxy->hole_check_mode());
+      BuildVariableLoadForAccumulatorValue(proxy, proxy->hole_check_mode());
       builder()->StoreAccumulatorInRegister(callee);
       break;
     }
@@ -5898,6 +6231,33 @@ void BytecodeGenerator::VisitCall(Call* expr) {
     receiver_arg_count = implicit_undefined_receiver ? 0 : 1;
     CHECK_EQ(receiver_arg_count + expr->arguments()->length(),
              args.register_count());
+
+    // 
+
+    // args format :: arguments, accumulator, start_position,
+    // expression_position
+
+    builder()->StoreAccumulatorInRegister(
+        register_allocator()->GrowRegisterList(&args));
+
+    // starting position of current scope
+    builder()
+        ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+        .StoreAccumulatorInRegister(
+            register_allocator()->GrowRegisterList(&args));
+
+    // expression position
+    builder()
+        ->LoadLiteral(Smi::FromInt(expr->position()))
+        .StoreAccumulatorInRegister(
+            register_allocator()->GrowRegisterList(&args));
+
+    builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitCallArguments, args);
+
+    args = args.Truncate(args.register_count() - 3);
+    // remove stored accumulator, scope position, expr position
+
+    //  :: changes end
   }
 
   // Resolve callee for a potential direct eval call. This block will mutate the
@@ -5937,6 +6297,40 @@ void BytecodeGenerator::VisitCall(Call* expr) {
     builder()
         ->CallRuntime(Runtime::kResolvePossiblyDirectEval, runtime_call_args)
         .StoreAccumulatorInRegister(callee);
+
+    //  :: On visit call arguments
+
+    Register backup_reg = register_allocator()->NewRegister();
+
+    builder()->StoreAccumulatorInRegister(backup_reg);
+
+    RegisterList runtime_call_args_OVC =
+        register_allocator()->NewGrowableRegisterList();
+
+    for (int i = 0; i < args.register_count(); i++) {
+      builder()->LoadAccumulatorWithRegister(args[i]);
+      builder()->StoreAccumulatorInRegister(
+          register_allocator()->GrowRegisterList(&runtime_call_args_OVC));
+    }
+
+    // we do this to make it similar to the original onvisitcallarguments
+    builder()->MoveRegister(backup_reg, register_allocator()->GrowRegisterList(
+                                            &runtime_call_args_OVC));
+
+    // starting position of current scope
+    builder()
+        ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+        .StoreAccumulatorInRegister(
+            register_allocator()->GrowRegisterList(&runtime_call_args_OVC));
+
+    // expression position
+    builder()
+        ->LoadLiteral(Smi::FromInt(expr->position()))
+        .StoreAccumulatorInRegister(
+            register_allocator()->GrowRegisterList(&runtime_call_args_OVC));
+
+    builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitCallArguments,
+                           runtime_call_args_OVC);
   }
 
   builder()->SetExpressionPosition(expr);
@@ -5952,12 +6346,100 @@ void BytecodeGenerator::VisitCall(Call* expr) {
     DCHECK(!implicit_undefined_receiver);
     builder()->CallProperty(callee, args,
                             feedback_index(feedback_spec()->AddCallICSlot()));
+
+    //  :: Added property logging
+
+    if (expr->expression()->IsProperty() &&
+        expr->expression()->AsProperty()->key()->IsPropertyName()) {
+      RegisterAllocationScope inner_register_scope(this);
+
+      RegisterList runtime_call_args =
+          register_allocator()->NewGrowableRegisterList();
+
+      // return value of the call
+      builder()->StoreAccumulatorInRegister(
+          register_allocator()->GrowRegisterList(&runtime_call_args));
+
+      // args passed to the call
+      for (int i = 0; i < args.register_count(); i++) {
+        builder()->LoadAccumulatorWithRegister(args[i]);
+        builder()->StoreAccumulatorInRegister(
+            register_allocator()->GrowRegisterList(&runtime_call_args));
+      }
+
+      // Scope position
+      builder()
+          ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+          .StoreAccumulatorInRegister(
+              register_allocator()->GrowRegisterList(&runtime_call_args));
+
+      // expression position
+      builder()
+          ->LoadLiteral(Smi::FromInt(expr->position()))
+          .StoreAccumulatorInRegister(
+              register_allocator()->GrowRegisterList(&runtime_call_args));
+
+      // Contains the name of property that is requested (ex. URL in
+      // document.URL)
+      builder()
+          ->LoadLiteral(expr->expression()
+                            ->AsProperty()
+                            ->key()
+                            ->AsLiteral()
+                            ->AsRawPropertyName())
+          .StoreAccumulatorInRegister(
+              register_allocator()->GrowRegisterList(&runtime_call_args));
+
+      builder()->CallRuntime(Runtime::kTaintAnalysis_OnVisitPropertyCall,
+                             runtime_call_args);
+    }
+    //    :: Property logging over
+
   } else if (implicit_undefined_receiver) {
+    // for global calls ?? like alert('testing')
     builder()->CallUndefinedReceiver(
         callee, args, feedback_index(feedback_spec()->AddCallICSlot()));
+
+    RegisterList runtime_call_args =
+        register_allocator()->NewGrowableRegisterList();
+
+    // return value of the call
+    builder()->StoreAccumulatorInRegister(
+        register_allocator()->GrowRegisterList(&runtime_call_args));
+
+//store calle in register list
+
+      builder()->LoadAccumulatorWithRegister(callee);
+      builder()->StoreAccumulatorInRegister(
+          register_allocator()->GrowRegisterList(&runtime_call_args));
+
+
+    // args passed to the call
+    for (int i = 0; i < args.register_count(); i++) {
+      builder()->LoadAccumulatorWithRegister(args[i]);
+      builder()->StoreAccumulatorInRegister(
+          register_allocator()->GrowRegisterList(&runtime_call_args));
+    }
+
+          // Scope position
+      builder()
+          ->LoadLiteral(Smi::FromInt(current_scope()->start_position()))
+          .StoreAccumulatorInRegister(
+              register_allocator()->GrowRegisterList(&runtime_call_args));
+
+      // expression position
+      builder()
+          ->LoadLiteral(Smi::FromInt(expr->position()))
+          .StoreAccumulatorInRegister(
+              register_allocator()->GrowRegisterList(&runtime_call_args));
+
+    builder()->CallRuntime(Runtime::kTaintAnalysis_JustPrintArgs,
+                           runtime_call_args);
+
   } else {
     builder()->CallAnyReceiver(
         callee, args, feedback_index(feedback_spec()->AddCallICSlot()));
+
   }
 }
 
@@ -6206,7 +6688,7 @@ void BytecodeGenerator::VisitForTypeOfValue(Expression* expr) {
     // Typeof does not throw a reference error on global variables, hence we
     // perform a non-contextual load in case the operand is a variable proxy.
     VariableProxy* proxy = expr->AsVariableProxy();
-    BuildVariableLoadForAccumulatorValue(proxy->var(), proxy->hole_check_mode(),
+    BuildVariableLoadForAccumulatorValue(proxy, proxy->hole_check_mode(),
                                          TypeofMode::kInside);
   } else {
     VisitForAccumulatorValue(expr);
@@ -6376,8 +6858,7 @@ void BytecodeGenerator::VisitCountOperation(CountOperation* expr) {
   switch (assign_type) {
     case NON_PROPERTY: {
       VariableProxy* proxy = expr->expression()->AsVariableProxy();
-      BuildVariableLoadForAccumulatorValue(proxy->var(),
-                                           proxy->hole_check_mode());
+      BuildVariableLoadForAccumulatorValue(proxy, proxy->hole_check_mode());
       break;
     }
     case NAMED_PROPERTY: {
@@ -6404,7 +6885,7 @@ void BytecodeGenerator::VisitCountOperation(CountOperation* expr) {
       BuildThisVariableLoad();
       builder()->StoreAccumulatorInRegister(load_super_args[0]);
       BuildVariableLoad(
-          property->obj()->AsSuperPropertyReference()->home_object()->var(),
+          property->obj()->AsSuperPropertyReference()->home_object(),
           HoleCheckMode::kElided);
       builder()->StoreAccumulatorInRegister(load_super_args[1]);
       builder()
@@ -6419,7 +6900,7 @@ void BytecodeGenerator::VisitCountOperation(CountOperation* expr) {
       BuildThisVariableLoad();
       builder()->StoreAccumulatorInRegister(load_super_args[0]);
       BuildVariableLoad(
-          property->obj()->AsSuperPropertyReference()->home_object()->var(),
+          property->obj()->AsSuperPropertyReference()->home_object(),
           HoleCheckMode::kElided);
       builder()->StoreAccumulatorInRegister(load_super_args[1]);
       VisitForRegisterValue(property->key(), load_super_args[2]);
@@ -6481,8 +6962,7 @@ void BytecodeGenerator::VisitCountOperation(CountOperation* expr) {
   switch (assign_type) {
     case NON_PROPERTY: {
       VariableProxy* proxy = expr->expression()->AsVariableProxy();
-      BuildVariableAssignment(proxy->var(), expr->op(),
-                              proxy->hole_check_mode());
+      BuildVariableAssignment(proxy, expr->op(), proxy->hole_check_mode());
       break;
     }
     case NAMED_PROPERTY: {
@@ -7574,6 +8054,10 @@ void BytecodeGenerator::VisitAndPushIntoRegisterList(Expression* expr,
   // leaks for deep expressions due to dead objects being kept alive by pointers
   // in registers.
   Register destination = register_allocator()->GrowRegisterList(reg_list);
+
+  builder()->StoreAccumulatorInRegister(destination);
+  builder()->CallRuntime(Runtime::kTaintAnalysis_ReplaceSmiResult, destination);
+
   builder()->StoreAccumulatorInRegister(destination);
 }
 
diff --git a/src/interpreter/bytecode-generator.h b/src/interpreter/bytecode-generator.h
index f838c8a..b32348c 100644
--- a/src/interpreter/bytecode-generator.h
+++ b/src/interpreter/bytecode-generator.h
@@ -263,12 +263,27 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
 
   void BuildVariableLoad(Variable* variable, HoleCheckMode hole_check_mode,
                          TypeofMode typeof_mode = TypeofMode::kNotInside);
+
+
+  void BuildVariableLoad(VariableProxy* variable, HoleCheckMode hole_check_mode,
+                         TypeofMode typeof_mode = TypeofMode::kNotInside);       
+
   void BuildVariableLoadForAccumulatorValue(
       Variable* variable, HoleCheckMode hole_check_mode,
       TypeofMode typeof_mode = TypeofMode::kNotInside);
+
+  void BuildVariableLoadForAccumulatorValue(
+      VariableProxy* variable, HoleCheckMode hole_check_mode,
+      TypeofMode typeof_mode = TypeofMode::kNotInside);
+
   void BuildVariableAssignment(
       Variable* variable, Token::Value op, HoleCheckMode hole_check_mode,
       LookupHoistingMode lookup_hoisting_mode = LookupHoistingMode::kNormal);
+
+  void BuildVariableAssignment(
+      VariableProxy* variable, Token::Value op, HoleCheckMode hole_check_mode,
+      LookupHoistingMode lookup_hoisting_mode = LookupHoistingMode::kNormal);
+
   void BuildLiteralCompareNil(Token::Value compare_op,
                               BytecodeArrayBuilder::NilValue nil);
   void BuildLiteralStrictCompareBoolean(Literal* literal);
diff --git a/src/interpreter/constant-array-builder.cc b/src/interpreter/constant-array-builder.cc
index 8591a37..873e33e 100644
--- a/src/interpreter/constant-array-builder.cc
+++ b/src/interpreter/constant-array-builder.cc
@@ -192,11 +192,11 @@ Handle<FixedArray> ConstantArrayBuilder::ToFixedArray(IsolateT* isolate) {
     DCHECK_EQ(slice->reserved(), 0);
     DCHECK(array_index == 0 ||
            base::bits::IsPowerOfTwo(static_cast<uint32_t>(array_index)));
-#if DEBUG
-    // Different slices might contain the same element due to reservations, but
-    // all elements within a slice should be unique.
-    slice->CheckAllElementsAreUnique(isolate);
-#endif
+// #if DEBUG
+//     // Different slices might contain the same element due to reservations, but
+//     // all elements within a slice should be unique.
+//     slice->CheckAllElementsAreUnique(isolate);
+// #endif
     // Copy objects from slice into array.
     for (size_t i = 0; i < slice->size(); ++i) {
       Handle<Object> value =
diff --git a/src/json/json-stringifier.cc b/src/json/json-stringifier.cc
index 1424452..c2619fb 100644
--- a/src/json/json-stringifier.cc
+++ b/src/json/json-stringifier.cc
@@ -31,6 +31,8 @@ class JsonStringifier {
                                                       Handle<Object> gap);
 
  private:
+  bool tainted;
+  std::string taint_source_str;
   enum Result { UNCHANGED, SUCCESS, EXCEPTION };
 
   bool InitializeReplacer(Handle<Object> replacer);
@@ -213,11 +215,14 @@ const char* const JsonStringifier::JsonEscapeTable =
     "\xFC\0      \xFD\0      \xFE\0      \xFF\0      ";
 
 JsonStringifier::JsonStringifier(Isolate* isolate)
-    : isolate_(isolate),
+    : tainted(false),
+      isolate_(isolate),
       builder_(isolate),
       gap_(nullptr),
       indent_(0),
-      stack_() {}
+      stack_() {
+  taint_source_str = "[-1]";  // represents JSON.stringify
+}
 
 MaybeHandle<Object> JsonStringifier::Stringify(Handle<Object> object,
                                                Handle<Object> replacer,
@@ -226,13 +231,25 @@ MaybeHandle<Object> JsonStringifier::Stringify(Handle<Object> object,
     CHECK(isolate_->has_pending_exception());
     return MaybeHandle<Object>();
   }
+
+  if (isolate_->IsV8ObjectTainted(object)) {
+    tainted = true;
+  }
+
   if (!gap->IsUndefined(isolate_) && !InitializeGap(gap)) {
     CHECK(isolate_->has_pending_exception());
     return MaybeHandle<Object>();
   }
   Result result = SerializeObject(object);
   if (result == UNCHANGED) return factory()->undefined_value();
-  if (result == SUCCESS) return builder_.Finish();
+  if (result == SUCCESS) {
+    MaybeHandle<Object> maybe_result = builder_.Finish();
+    if (tainted) {
+      isolate_->SetTaintForV8Object(maybe_result.ToHandleChecked(),
+                                    taint_source_str.c_str());
+    }
+    return maybe_result;
+  }
   DCHECK(result == EXCEPTION);
   CHECK(isolate_->has_pending_exception());
   return MaybeHandle<Object>();
@@ -530,6 +547,35 @@ template <bool deferred_string_key>
 JsonStringifier::Result JsonStringifier::Serialize_(Handle<Object> object,
                                                     bool comma,
                                                     Handle<Object> key) {
+  //  :: check for taint and set the result
+
+  if (isolate_->IsV8ObjectTainted(object)) {
+    tainted = true;
+
+    std::string new_source = isolate_->getObjectTaintSource(object);
+
+    if (!new_source.empty()) {
+      size_t start_bracket = new_source.find("[");
+      size_t end_bracket = new_source.find("]");
+
+      std::string id_str, new_sources;
+
+      while (start_bracket != std::string::npos) {
+        id_str =
+            new_source.substr(start_bracket, end_bracket - start_bracket + 1);
+
+        if (taint_source_str.find(id_str) == std::string::npos) {
+          new_sources += id_str;
+        }
+
+        start_bracket = new_source.find("[", end_bracket + 1);
+        end_bracket = new_source.find("]", end_bracket + 1);
+      }
+
+      taint_source_str = taint_source_str + new_sources;
+    }
+  }
+
   StackLimitCheck interrupt_check(isolate_);
   if (interrupt_check.InterruptRequested() &&
       isolate_->stack_guard()->HandleInterrupts().IsException(isolate_)) {
diff --git a/src/objects/hash-table-inl.h b/src/objects/hash-table-inl.h
index 160e4cd..c7fe9ad 100644
--- a/src/objects/hash-table-inl.h
+++ b/src/objects/hash-table-inl.h
@@ -196,6 +196,56 @@ InternalIndex HashTable<Derived, Shape>::FindEntry(PtrComprCageBase cage_base,
   }
 }
 
+//  :: Added a custom object hash table with modified find entry (with ptr)
+
+template <typename Derived, typename Shape>
+template <typename IsolateT>
+InternalIndex ObjectHashTableBase<Derived, Shape>::FindEntry(
+    IsolateT* isolate, Handle<Object> key) {
+  ReadOnlyRoots roots(isolate);
+  return FindEntry(isolate, roots, key, Shape::Hash(roots, key));
+}
+
+// Find entry for key otherwise return kNotFound.
+template <typename Derived, typename Shape>
+InternalIndex ObjectHashTableBase<Derived, Shape>::FindEntry(
+    PtrComprCageBase cage_base, ReadOnlyRoots roots, Handle<Object> key,
+    int32_t hash) {
+  DisallowGarbageCollection no_gc;
+  // Isolate* isolate1 = Heap::FromWritableHeapObject(*this)->isolate();
+
+  Isolate* isolate = Isolate::Current();
+// std::cout<<"\nFind Entry :: Isolate " << isolate << " Isolate1 " << isolate1;
+
+  Handle<Object> table_handle(*this, isolate);
+
+// #ifdef DEBUG
+//   if (isolate->inRKDebugMode()) {
+//     std::cout << "\nFind Entry :: Table Handle " << table_handle->ptr();
+//   }
+// #endif
+
+  uint32_t capacity = this->Capacity();
+  uint32_t count = 1;
+  Object undefined = roots.undefined_value();
+  Object the_hole = roots.the_hole_value();
+  // EnsureCapacity will guarantee the hash table is never full.
+  for (InternalIndex entry = this->FirstProbe(hash, capacity);;
+       entry = this->NextProbe(entry, count++, capacity)) {
+    Object element = this->KeyAt(cage_base, entry);
+    // Empty entry. Uses raw unchecked accessors because it is called by the
+    // string table during bootstrapping.
+    if (element == undefined) return InternalIndex::NotFound();
+    if (Shape::kMatchNeedsHoleCheck && element == the_hole) continue;
+    if (isolate->isTaintTable(table_handle)) {
+      if (key->ptr() == element.ptr()) return entry;
+    } else {
+      if (Shape::IsMatch(key, element)) return entry;
+    }
+  }
+}
+
+
 template <typename Derived, typename Shape>
 template <typename IsolateT>
 InternalIndex HashTable<Derived, Shape>::FindInsertionEntry(IsolateT* isolate,
diff --git a/src/objects/hash-table.h b/src/objects/hash-table.h
index f5a5429..87c06b0 100644
--- a/src/objects/hash-table.h
+++ b/src/objects/hash-table.h
@@ -340,6 +340,13 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) ObjectHashTableBase
   Object Lookup(Handle<Object> key, int32_t hash);
   Object Lookup(PtrComprCageBase cage_base, Handle<Object> key, int32_t hash);
 
+//  :: modify the findentry function
+  inline InternalIndex FindEntry(PtrComprCageBase cage_base,
+                                 ReadOnlyRoots roots, Handle<Object> key, int32_t hash);
+
+  template <typename IsolateT>
+  inline InternalIndex FindEntry(IsolateT* isolate, Handle<Object> key);
+
   // Returns the value at entry.
   Object ValueAt(InternalIndex entry);
 
diff --git a/src/objects/objects-inl.h b/src/objects/objects-inl.h
index 3b3c4a4..795d2a5 100644
--- a/src/objects/objects-inl.h
+++ b/src/objects/objects-inl.h
@@ -1200,6 +1200,28 @@ Object Object::GetSimpleHash(Object object) {
     uint32_t hash = ComputeUnseededHash(Smi::ToInt(object));
     return Smi::FromInt(hash & Smi::kMaxValue);
   }
+
+  //  :: Hash for non-JSReceiver objects
+
+  // Do NOT use pointer hash here, since GC can change the memory
+  // address of an object.
+  if (object.IsJSFunction()) {
+    uint32_t hash = ComputeSeededHash(
+        JSFunction::cast(object).shared().SourceSize(), kZeroHashSeed);
+    return Smi::FromInt(hash & Smi::kMaxValue);
+  } else if (object.IsSharedFunctionInfo()) {
+    uint32_t hash = ComputeSeededHash(
+        SharedFunctionInfo::cast(object).SourceSize(), kZeroHashSeed);
+    return Smi::FromInt(hash & Smi::kMaxValue);
+  } else if (object.IsContext()) {
+    JSGlobalObject global_object = Context::cast(object).global_object();
+    CHECK(global_object.IsJSGlobalObject());
+    return global_object.GetHash();
+  } else {
+    return Smi::FromInt(Smi::kMaxValue);
+  }
+
+
   auto instance_type = HeapObject::cast(object).map().instance_type();
   if (InstanceTypeChecker::IsHeapNumber(instance_type)) {
     double num = HeapNumber::cast(object).value();
diff --git a/src/runtime/runtime-taint.cc b/src/runtime/runtime-taint.cc
new file mode 100644
index 0000000..c062e1a
--- /dev/null
+++ b/src/runtime/runtime-taint.cc
@@ -0,0 +1,1768 @@
+#include "src/runtime/runtime-taint.h"
+
+#include <iostream>
+
+// #include "json.hpp"
+#include "src/execution/arguments-inl.h"
+
+// using json = nlohmann::json;
+// loggers and conversion extracted from VisibleV8
+
+namespace v8 {
+namespace internal {
+
+#define UNDEFINED_VALUE_HEAP ReadOnlyRoots(isolate).undefined_value()
+
+//   enum class Type {
+//     kNative = 0,
+//     kExtension = 1,
+//     kNormal = 2,
+// #if V8_ENABLE_WEBASSEMBLY
+//     kWasm = 3,
+// #endif  // V8_ENABLE_WEBASSEMBLY
+//     kInspector = 4
+//   };
+
+// defined in v8/src/objects/script.h
+
+#define IGNORE_NON_PROPAGATION_CONTEXTS(isolate, ignore_builtin, retval) \
+  do {                                                                   \
+    JavaScriptStackFrameIterator it(isolate);                            \
+    Handle<JSFunction> function(it.frame()->function(), isolate);        \
+    Handle<SharedFunctionInfo> shared_info(function->shared(), isolate); \
+    Handle<Script> script(Script::cast(shared_info->script()), isolate); \
+    if (ignore_builtin && !shared_info.is_null() &&                      \
+        script->type() != Script::Type::kNormal) {                       \
+      return (retval);                                                   \
+    }                                                                    \
+  } while (false)
+
+//  :: v8 runtime functions
+
+// Fastpath replacement for "PrintUC16" that doesn't rely on snprintf
+static void myPrintUC16(String str, std::ostream& out, int start = 0,
+                        int end = -1) {
+  static char digits[] = "0123456789abcdef";
+  char buff[4096];
+  char* bp = buff;
+  char* bmax = buff + sizeof(buff) - 6;  // max length char escape is 6 chars
+
+  if (end < 0) end = str.length();
+  StringCharacterStream src(str, start);
+  for (int i = start; i < end && src.HasMore(); ++i) {
+    auto c = src.GetNext();
+    if (c < ' ') {
+      // Unprintable ASCII ("\xEscaped")
+      *bp++ = '\\';
+      *bp++ = 'x';
+      *bp++ = digits[(c & 0xf0) >> 4];
+      *bp++ = digits[(c & 0x0f)];
+    } else if (c <= '~') {
+      // Printable ASCII
+      if (c == ':' || c == '\\') {  // handle escapes for our output delimiter
+        *bp++ = '\\';
+      }
+      *bp++ = (char)c;
+    } else {
+      // UC16 (\UEscaped)
+      *bp++ = '\\';
+      *bp++ = 'u';
+      *bp++ = digits[(c & 0xf000) >> 12];
+      *bp++ = digits[(c & 0x0f00) >> 8];
+      *bp++ = digits[(c & 0x00f0) >> 4];
+      *bp++ = digits[(c & 0x000f)];
+    }
+
+    // Capacity flush
+    if (bp >= bmax) {
+      out.write(buff, bp - buff);
+      bp = buff;
+    }
+  }
+
+  // Remainder flush
+  if (bp > buff) {
+    out.write(buff, bp - buff);
+  }
+}
+
+// Fastpath stringify for something simple (Smi, String, ...)
+// (extracted from various 8-cylinder printing functions around V8, all too
+// general/too slow)
+void visv8_to_string(Isolate* isolate, std::ostream& out, Object obj,
+                     bool quotes = true, int max_len = -1,
+                     bool iter_obj = false) {
+  HandleScope scope(isolate);
+
+  if (obj.IsSmi()) {
+    // Fine, print the stupid integer...
+    out << Smi::cast(obj).value();
+  } else {
+    // Determine type of HeapObject...
+    if (obj.IsString()) {
+      if (quotes) {
+        out << '"';
+      }
+      myPrintUC16(String::cast(obj), out, 0, max_len);
+      if (quotes) {
+        out << '"';
+      }
+    } else if (obj.IsNumber()) {
+      out << obj.Number();
+    } else if (obj.IsOddball()) {
+      switch (Oddball::cast(obj).kind()) {
+        case Oddball::kFalse:
+          out << "#F";
+          break;
+        case Oddball::kTrue:
+          out << "#T";
+          break;
+        case Oddball::kNull:
+          out << "#N";
+          break;
+        case Oddball::kUndefined:
+          out << "#U";
+          break;
+        default:
+          out << "#?";
+      }
+    } else if (obj.IsJSFunction()) {
+      auto info = JSFunction::cast(obj).shared();
+      if (!info.IsUserJavaScript()) {
+        out << '%';
+      }
+
+      auto name = info.Name();
+      if (name.length()) {
+        myPrintUC16(name, out, 0, max_len);
+      } else {
+        out << "<anonymous>";
+      }
+    } else if (obj.IsJSRegExp()) {
+      out << '/';
+      myPrintUC16(JSRegExp::cast(obj).EscapedPattern(), out, 0, max_len);
+      out << '/';
+    } else if (obj.IsJSReceiver()) {
+      Handle<JSReceiver> rcvr = handle(JSReceiver::cast(obj), isolate);
+      out << '{';
+
+      Handle<String> ctor = JSReceiver::GetConstructorName(isolate, rcvr);
+      myPrintUC16(*ctor, out, 0, max_len);
+
+      out << '}';
+    } else {
+      out << '?';
+    }
+  }
+}
+
+// TLS storage slot key for per-thread output streams for our trace logging
+static pthread_key_t visv8_out_key;
+
+// Type used to aggregate all TLS data into one POD object
+struct VisV8TlsData {
+  // Since looking up window.origin can trigger recursion, we need to know when
+  // to ignore API calls
+  int rcount;
+
+  // std filestream used to log records to disk for this thread
+  std::ofstream log;
+
+  // Context (last-encountered Isolate, and last SID within that Isolate)
+  Isolate* last_isolate;
+  int last_script_id;
+  bool isolate_changed;
+
+  // Log file name generator pattern (for log rollover on large size)
+  int next_log;
+  char log_name_pattern[256];
+
+  // Small/simple "set" of seen Isolate/SID pairs (to avoid re-dumping script
+  // source/etc. within one log)
+  std::vector<std::pair<Isolate*, int> > seen_sids;
+
+  // To track @origin (SOP), we need to look up the window.origin string; keep a
+  // cached copy (and a scratch buffer)
+  std::ostrstream last_origin_url;
+  std::ostrstream origin_url_scratch;
+
+  // Dumb constructor
+  VisV8TlsData()
+      : rcount(0),
+        last_isolate(nullptr),
+        last_script_id(-1),
+        isolate_changed(true),
+        next_log(0) {
+    // HACK: only direct pthread call can recover thread "name" [can't get
+    // current Thread object from V8?]
+    char thread_name[16] = "<unknown>";
+#if BUILDFLAG(IS_ANDROID)
+    if (prctl(PR_GET_NAME, thread_name, 0, 0, 0)) {
+      perror("prctl");
+    }
+    char log_name[] = "/sdcard/Documents/rk_taint_path-%ld-%d-%d-%s.%%d.log";
+#else
+    if (pthread_getname_np(pthread_self(), thread_name, sizeof(thread_name))) {
+      perror("pthread_getname_np");
+    }
+    char log_name[] = "rk_taint_path-%ld-%d-%d-%s.%%d.log";
+#endif
+    // Use thread name et al. to construct our log name pattern
+    snprintf(log_name_pattern, sizeof log_name_pattern, log_name,
+             (long)base::OS::TimeCurrentMillis(),
+             base::OS::GetCurrentProcessId(), base::OS::GetCurrentThreadId(),
+             thread_name);
+
+    // snprintf(log_name_pattern, sizeof log_name_pattern, "rk_taint_path.log");
+
+    // And go ahead/open our next log file
+    open_next_log_file();
+
+    last_origin_url << std::ends;  // Initialize this to the empty string to
+                                   // avoid sadness later
+  }
+
+  void open_next_log_file() {
+    char log_name[256];
+
+    if (log.is_open()) log.close();
+    snprintf(log_name, sizeof log_name, log_name_pattern, next_log++);
+    log.open(log_name);
+
+    if (!log) {
+      perror(log_name);
+      abort();
+    }
+  }
+
+  // Destructor: close and delete file stream object, reset all key fields to
+  // null/invalid state
+  ~VisV8TlsData() {
+    log.close();
+    last_origin_url.freeze(
+        false);  // Make sure the ostrstreams can release their buffers here
+    origin_url_scratch.freeze(false);
+    reset_isolate(nullptr);
+  }
+
+  // Reset all context state for a new/different isolate
+  void reset_isolate(Isolate* isolate) {
+    last_isolate = isolate;
+    last_origin_url.clear();
+    last_script_id = -1;
+    isolate_changed = true;
+  }
+
+  // Log the current "last_isolate"
+  void log_isolate() {
+    log << '~' << (void*)last_isolate << '\n';
+    isolate_changed = false;
+  }
+
+  // Predicate: have we logged a given isolate/SID pair yet?
+  bool check_sid(Isolate* isolate, int sid) {
+    return std::binary_search(std::begin(seen_sids), std::end(seen_sids),
+                              std::make_pair(isolate, sid));
+  }
+
+  // Utility: insert an isolate/SID pair into our primitive set (no checks for
+  // duplicates)
+  void add_sid(Isolate* isolate, int sid) {
+    auto val = std::make_pair(isolate, sid);
+    seen_sids.insert(
+        std::upper_bound(std::begin(seen_sids), std::end(seen_sids), val), val);
+  }
+
+  // Utility: log a '$' record for the given script object
+  void log_script(Isolate* isolate, Script script) {
+    add_sid(isolate, script.id());
+
+    // Check for eval nesting (i.e., a parent script that may need to be dumped
+    // first)
+    if (script.has_eval_from_shared()) {
+      auto sfi = SharedFunctionInfo::cast(script.eval_from_shared());
+      if (sfi.script().IsScript()) {
+        auto parent = Script::cast(sfi.script());
+
+        // Yes, dump that parent... (if needed)
+        if (!check_sid(isolate, parent.id())) {
+          log_script(isolate, parent);
+        }
+
+        log << '$' << script.id() << ':' << parent.id();
+      } else {
+        // Well, we were eval'd, but we couldn't identify the parent script??
+        log << '$' << script.id() << ":#?";
+      }
+    } else {
+      // No parent, so print the script name
+      log << '$' << script.id() << ':';
+      visv8_to_string(isolate, log, script.name());
+    }
+
+    // Always finish with the source code (unquoted)
+    log << ':';
+    visv8_to_string(isolate, log, script.source(), false);
+    log << '\n';
+  }
+
+ private:
+  // Helper to "print" the current origin value to an ostream
+  void print_origin(Isolate* isolate, std::ostream& out) {
+    HandleScope hs(isolate);
+
+    // Try to get the global object and print its "origin" property
+    Handle<JSGlobalObject> native_global =
+        handle(isolate->native_context()->global_object(), isolate);
+    if (native_global->GetEmbedderFieldCount() >= 2) {
+      // Littered with evil hacks to work around WebKit/Blink's brokenness
+      // w.r.t. initializing its Window object
+      if (native_global->GetEmbedderField(1).IsSmi()) {
+        auto origin = JSReceiver::GetProperty(isolate, native_global, "origin");
+        Handle<Object> origin_value;
+        if (origin.ToHandle(&origin_value)) {
+          out << "\nORIGIN@";
+          visv8_to_string(isolate, out, *origin_value);
+          out << '\n';
+          return;  // Early out
+        }
+      }
+    }
+
+    // Fallback, if anything went wrong
+    out << "@?\n";
+  }
+
+ public:
+  // Utility: log the current ".origin" property of the current global object
+  // (if any)
+  void log_origin(Isolate* isolate) {
+    // Clear out the scratch buffer & print the origin string to it
+    origin_url_scratch.freeze(false);
+    origin_url_scratch.seekp(0);
+    origin_url_scratch.clear();
+    print_origin(isolate, origin_url_scratch);
+    origin_url_scratch << std::ends;
+
+    // Now, compare with our cached copy
+    if (strcmp(origin_url_scratch.str(), last_origin_url.str()) != 0) {
+      // Change!  Replace our cached copy and log it
+      last_origin_url.freeze(false);
+      last_origin_url.seekp(0);
+      last_origin_url.clear();
+      last_origin_url << origin_url_scratch.str() << std::ends;
+      log << last_origin_url.str();
+    }
+  }
+};
+
+// Thread-exit destructor (to close any per-thread logging file opened, etc.)
+static void visv8_thread_exit_flusher(void* arg) {
+  auto data =
+      static_cast<VisV8TlsData*>(arg);  // pthread guarantees this is not NULL
+  delete data;
+  pthread_setspecific(visv8_out_key, nullptr);
+}
+
+// Initialization routine for VisV8's TLS slot (must call-once per process,
+// before any visv8 callbacks)
+void visv8_tls_init() {
+  // HACK: only direct pthread calls give us thread destructors [V8's xplatform
+  // thread stuff won't]
+  if (pthread_key_create(&visv8_out_key, visv8_thread_exit_flusher)) {
+    perror("pthread_key_create");
+  }
+}
+
+// Self-contained "clean up the current thread's TLS stuff" function for use by
+// external shutdown logic (e.g., atexit)
+void visv8_tls_fini() {
+  auto data = pthread_getspecific(visv8_out_key);
+  if (data) {
+    visv8_thread_exit_flusher(data);
+  }
+}
+
+// RAII "handle" to VV8 per-thread context; keep strictly lexically scoped!
+// (currently no actual destruction happening)
+class VisV8Context {
+  VisV8TlsData* data;
+
+ public:
+  explicit VisV8Context(Isolate* current_isolate) {
+    // Get the TLS data for this thread
+    data = static_cast<VisV8TlsData*>(pthread_getspecific(visv8_out_key));
+
+    // If it doesn't exist yet, initialize it
+    if (!data) {
+      // This will initialize all our state and open the [first] log file (or
+      // die)
+      data = new VisV8TlsData();
+      DCHECK_NE(data, nullptr);
+
+      if (pthread_setspecific(visv8_out_key, data)) {
+        perror("pthread_setspecific");
+      } else {
+        // Another hack: since pthreads doesn't call thread destructors on the
+        // "main thread" (since it doesn't call pthread_exit), and since calling
+        // pthread_exit inside an atexit() handler is NO BUENO (it can and will
+        // disrupt clean process shutdown), we need to set up a special ad hoc
+        // thread destructor for the "main thread" using atexit EXTRA HACKY:
+        // there is no portable pthreads API for determining "main thread"
+        // status; use this Linux-only hack for now...
+        if (syscall(SYS_gettid) == getpid()) {
+          atexit(visv8_tls_fini);
+        }
+      }
+    }
+
+    // Check for Isolate/scriptID invalidation based on current isolate
+    if (current_isolate != data->last_isolate) {
+      data->reset_isolate(current_isolate);
+    }
+
+    // Bump our recursion count
+    ++data->rcount;
+  }
+
+  // On cleanup of this context, decrement our recursion count
+  ~VisV8Context() { --data->rcount; }
+
+  bool isolate_changed() const { return data->isolate_changed; }
+
+  bool is_recursive() const { return data->rcount > 1; }
+
+  friend class VisV8Logger;
+};
+
+// RAII "handle" to VisV8 context's logging stream (lexically-scoped,
+// short-lived) (right now, trivially simple; if we later add in more
+// complicated [synchronized] log flushing, this will hide all of that nicely)
+class VisV8Logger {
+  VisV8TlsData* data;
+
+ public:
+  explicit VisV8Logger(const VisV8Context& context) : data(context.data) {
+    auto current_isolate =
+        data->last_isolate;  // Assume no change in isolate from the creation of
+                             // our context handle (lexical lifetimes)
+
+    // If the context has observed an isolate change, log that first...
+    if (context.isolate_changed()) {
+      data->log_isolate();
+    }
+
+    // Then, log the origin (which does its own caching/skipping logic)
+    data->log_origin(current_isolate);
+
+    // Now check script ID: has it changed?
+    DebuggableStackFrameIterator it(current_isolate);
+    if (!it.done() && it.is_javascript()) {
+      auto script = it.javascript_frame()->script();
+
+      if (script.id() != data->last_script_id) {
+        // OK, is this a new script we've never seen before?
+        if (!data->check_sid(current_isolate, script.id())) {
+          // Yes--log that script's source/genealogy
+          // data->log_script(current_isolate, script);
+        }
+
+        // Update our last-script-id and log the active script ID
+        data->last_script_id = script.id();
+        // out() << '!' << script.id() << '\n';
+      }
+    } else {
+      // Weird--we can't tell! (and this breaks our last script-id)
+      // out() << "!?\n";
+      data->last_script_id = -1;
+    }
+  }
+
+  ~VisV8Logger() {
+    // out() << std::endl;
+
+    // Trap I/O errors as fatal
+    if (!out()) {
+      perror("log output");
+      abort();
+    }
+
+    // Check to see if our log has grown too large; rollover...
+    if (out().tellp() > 1000 * 1000 * 1000) {  // Max 1GB per log file
+      data->open_next_log_file();
+    }
+  }
+
+  // Public access to the logging stream
+  std::ostream& out() const { return data->log; }
+};
+
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_JustPrintArgs) {
+  // IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, UNDEFINED_VALUE_HEAP);
+
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> return_value = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *return_value);
+
+#ifdef DEBUG
+  std::cout << "\nRuntime_TaintAnalysis_JustPrintArgs" << std::endl;
+
+  std::cout << "Printing " << args.length() << " Args\n";
+
+  for (int i = 0; i < args.length(); i++) {
+    std::cout << args.at(i) << std::endl << std::flush;
+  }
+#endif
+
+  Handle<Object> home_object = args.at(1);
+
+  JSFunction my_fun = JSFunction::cast(*home_object);
+
+  if (!my_fun.shared().IsApiFunction()) {
+    return *return_value;
+  }
+
+  bool tainted_object = false;
+  bool sink = false;
+
+  auto scope_position = args.smi_value_at(args.length() - 2);
+  auto expr_position = args.smi_value_at(args.length() - 1);
+
+#ifdef DEBUG
+  // std::cout<<"\nISAPI :: " << my_fun.shared().IsApiFunction()<<std::endl;
+#endif
+
+  SharedFunctionInfo info = JSFunction::cast(*home_object).shared();
+
+  String function_name = info.Name();
+
+  VisV8Context vctx(isolate);
+  VisV8Logger vlog(vctx);
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+    ParseInfo* info_ = isolate->GetCompilationInfo(function);
+    if (info_ == NULL) return *return_value;
+
+    ScopeDFG* dfg = isolate->GetScopeDFG(info_, scope_position);
+    if (dfg != NULL) dfg->PropagateTaint(it.frame());
+  }
+
+  std::string obj_name_str = "Window";
+  std::string prop_name_str = function_name.ToCString().get();
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\nCalled Object Prop Pair "
+              << obj_name_str + "." + prop_name_str;
+  }
+#endif
+
+  if (isolate->IsObjectPropertySink(obj_name_str, prop_name_str)) {
+    sink = true;
+    vlog.out() << "\nSINKPC$";
+    vlog.out() << '{' << obj_name_str << '}';
+    vlog.out() << ':';
+    vlog.out() << '"' << prop_name_str << '"';
+    vlog.out() << ':';
+
+    for (int i = 2; i < (args.length() - 2); i++) {
+      visv8_to_string(isolate, vlog.out(), *(args.at(i)));
+    }
+
+    for (int i = 2; i < (args.length() - 2); i++) {
+      if (isolate->IsV8ObjectTainted(args.at(i))) {
+        std::string decoded_source =
+            isolate->decodeSource(isolate->getObjectTaintSource(args.at(i)));
+        std::cout << "\nSensitive Data leaked :: ";
+        std::cout << decoded_source << std::endl << std::flush;
+
+        vlog.out() << "\nLEAK$" << expr_position << ':';
+        vlog.out() << '{' << obj_name_str << '}';
+        vlog.out() << ':';
+        vlog.out() << '"' << prop_name_str << '"';
+        // vlog.out() << ':';
+        // visv8_to_string(isolate, vlog.out(), *(args.at(i)));
+        vlog.out() << ':';
+        vlog.out() << decoded_source;
+      }
+    }
+  }
+
+  if (!sink && isolate->IsObjectPropertySource(obj_name_str, prop_name_str)) {
+    vlog.out() << "\nSOURCEPC$";
+    // visv8_to_string(isolate, vlog.out(), *home_object);
+    vlog.out() << '{' << obj_name_str << '}';
+    vlog.out() << ':';
+    // visv8_to_string(isolate, vlog.out(), *(property_name));
+    vlog.out() << '"' << prop_name_str << '"';
+
+#ifdef DEBUG
+    if (isolate->inRKDebugMode()) {
+      std::cout << "\nObject Property pair is a taint source  :: "
+                << obj_name_str + "." + prop_name_str;
+    }
+#endif
+
+    // Handle<String> str = isolate->factory()->NewStringFromAsciiChecked(
+    //     (obj_name_str + "." + prop_name_str).c_str());
+
+    std::string encoded_source =
+        isolate->encodeNameAndProperty(obj_name_str, prop_name_str);
+    // return_value = FilterInvalidV8Objects(isolate, return_value);
+
+    tainted_object = true;
+
+    isolate->SetTaintForV8Object(return_value, encoded_source);
+  }
+
+  if (tainted_object || isolate->IsV8ObjectTainted(return_value)) {
+    isolate->SetTaintForAstNode(function,
+                                reinterpret_cast<void*>(it.frame()->fp()),
+                                expr_position, AstNode::kCall);
+  } else {
+    isolate->UntaintAstNode(reinterpret_cast<void*>(it.frame()->fp()),
+                            expr_position, AstNode::kCall);
+  }
+
+  isolate->AddToObjectMap(reinterpret_cast<void*>(it.frame()->fp()),
+                          expr_position, AstNode::kCall, return_value);
+
+  return *return_value;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnVisitPropertyCall) {
+  // Args ::
+  // First position :: return value
+  // Second position :: object name (callee) :: example xhr.send(c) ,
+  // "XMLHttprequest" is the callee, "send" is the property
+  //  third position .... :: actual argument objects example c
+  // third to number of arguments passed to the call :: arguments passed
+  // Last - 2 position :: Scope position
+  // last - 1 position :: expression position
+  // Last position :: property name :: example "send"
+
+  // CHECK(args.length() == 3);
+
+  // if (!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  // if (args.length() <= 3) return UNDEFINED_VALUE_HEAP;
+
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> return_value = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *return_value);
+
+  bool tainted_object = false;
+  bool sink = false;
+
+  if (return_value->IsSmi()) {
+    return_value =
+        isolate->factory()->NewHeapNumber(return_value->ToSmi().value());
+  }
+
+  Handle<Object> home_object = args.at(1);
+
+  home_object = FilterInvalidV8Objects(isolate, home_object);
+  if (home_object.is_null() || home_object->IsSmi()) return *return_value;
+
+  auto scope_position = args.smi_value_at(args.length() - 3);
+  auto expr_position = args.smi_value_at(args.length() - 2);
+  Handle<String> property_name =
+      handle(String::cast(*args.at(args.length() - 1)), isolate);
+
+#ifdef DEBUG
+  if (true) {
+    std::cout << "\nRuntime_OnVisitPropertyCall :: " << args.length();
+    std::cout << "\n0. Return Value :: ";
+    return_value->Print();
+    std::cout << "1. Home Object :: ";
+    // home_object->Print();
+    std::cout << "Arguments :: ";
+    for (int i = 2; i < args.length() - 3; i++)
+      std::cout << std::endl << i << ". " << args.at(i);
+    std::cout << std::endl
+              << args.length() - 3 << ". Scope Position :: " << scope_position;
+    std::cout << std::endl
+              << args.length() - 2
+              << ". Expression Position :: " << expr_position;
+    std::cout << std::endl << args.length() - 1 << ". Property Name :: ";
+    property_name->Print();
+  }
+#endif
+
+  if (home_object->IsJSReceiver()) {
+    VisV8Context vctx(isolate);
+    VisV8Logger vlog(vctx);
+    Handle<JSReceiver> rcvr = handle(JSReceiver::cast(*home_object), isolate);
+    Handle<String> ctor = JSReceiver::GetConstructorName(isolate, rcvr);
+    JavaScriptStackFrameIterator it(isolate);
+    Handle<JSFunction> function(it.frame()->function(), isolate);
+
+    if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+      ParseInfo* info_ = isolate->GetCompilationInfo(function);
+      if (info_ == NULL) return *return_value;
+
+      ScopeDFG* dfg = isolate->GetScopeDFG(info_, scope_position);
+      if (dfg != NULL) dfg->PropagateTaint(it.frame());
+    }
+
+    std::string obj_name_str = ctor->ToCString().get();
+    std::string prop_name_str = property_name->ToCString().get();
+
+#ifdef DEBUG
+    if (isolate->inRKDebugMode()) {
+      std::cout << "\nCalled Object Prop Pair "
+                << obj_name_str + "." + prop_name_str;
+    }
+#endif
+    if (isolate->IsObjectPropertySink(obj_name_str, prop_name_str)) {
+      sink = true;
+      vlog.out() << "\nSINKPC$";
+      visv8_to_string(isolate, vlog.out(), *home_object);
+      vlog.out() << ':';
+      visv8_to_string(isolate, vlog.out(), *(property_name));
+      vlog.out() << ':';
+
+      for (int i = 2; i < (args.length() - 3); i++) {
+        visv8_to_string(isolate, vlog.out(), *(args.at(i)));
+      }
+
+      for (int i = 2; i < (args.length() - 3); i++) {
+        if (isolate->IsV8ObjectTainted(args.at(i))) {
+          std::string decoded_source =
+              isolate->decodeSource(isolate->getObjectTaintSource(args.at(i)));
+          std::cout << "\nSensitive Data leaked :: ";
+          std::cout << decoded_source << std::endl << std::flush;
+
+          vlog.out() << "\nLEAK$" << expr_position << ':';
+          visv8_to_string(isolate, vlog.out(), *home_object);
+          vlog.out() << ':';
+          visv8_to_string(isolate, vlog.out(), *property_name);
+          // vlog.out() << ':';
+          // visv8_to_string(isolate, vlog.out(), *(args.at(i)));
+          vlog.out() << ':';
+          vlog.out() << decoded_source;
+        }
+      }
+    }
+
+    // if (home_object->IsJSReceiver()) {
+    if (!sink && isolate->IsObjectPropertySource(obj_name_str, prop_name_str)) {
+      vlog.out() << "\nSOURCEPC$";
+      visv8_to_string(isolate, vlog.out(), *home_object);
+      vlog.out() << ':';
+      visv8_to_string(isolate, vlog.out(), *(property_name));
+
+      // for (int i = 2; i < (args.length() - 3); i++) {
+      //   visv8_to_string(isolate, vlog.out(), *(args.at(i)));
+      // }
+
+#ifdef DEBUG
+      if (isolate->inRKDebugMode()) {
+        std::cout << "\nObject Property pair is a taint source  :: "
+                  << obj_name_str + "." + prop_name_str;
+      }
+#endif
+
+      // Handle<String> str = isolate->factory()->NewStringFromAsciiChecked(
+      //     (obj_name_str + "." + prop_name_str).c_str());
+
+      std::string encoded_source =
+          isolate->encodeNameAndProperty(obj_name_str, prop_name_str);
+      // return_value = FilterInvalidV8Objects(isolate, return_value);
+
+      tainted_object = true;
+
+      isolate->SetTaintForV8Object(return_value, encoded_source);
+    }
+
+    if (tainted_object || isolate->IsV8ObjectTainted(return_value)) {
+      isolate->SetTaintForAstNode(function,
+                                  reinterpret_cast<void*>(it.frame()->fp()),
+                                  expr_position, AstNode::kCall);
+    } else {
+      isolate->UntaintAstNode(reinterpret_cast<void*>(it.frame()->fp()),
+                              expr_position, AstNode::kCall);
+    }
+
+    isolate->AddToObjectMap(reinterpret_cast<void*>(it.frame()->fp()),
+                            expr_position, AstNode::kCall, return_value);
+  }
+  return *return_value;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnVisitCallArguments) {
+  //  1st position ... :: actual value of arguments
+  // Last - 1 position :: Scope position
+  // last  position :: expression position
+
+  // CHECK(args.length() == 3);
+
+  // if (!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  HandleScope handle_scope(isolate);
+  Handle<Object> backup_obj = args.at(args.length() - 3);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *backup_obj);
+
+  auto scope_position = args.smi_value_at(args.length() - 2);
+  auto expr_position = args.smi_value_at(args.length() - 1);
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\n\nRuntime_OnVisitCallArguments :: " << args.length();
+
+    std::cout << "\nArguments :: ";
+    for (int i = 0; i < args.length() - 3; i++) {
+      std::cout << "\nArg " << i << ". " << args.at(i) << std::flush;
+    }
+
+    std::cout << std::endl << args.length() - 3 << ". Backup Object :: ";
+    // backup_obj->Print();
+
+    std::cout << args.length() - 2 << ". Scope Position :: " << scope_position;
+    std::cout << std::endl
+              << args.length() - 1
+              << ". Expression Position :: " << expr_position << std::endl
+              << std::flush;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+  if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+    ParseInfo* info_ = isolate->GetCompilationInfo(function);
+    if (info_ == NULL) return *backup_obj;
+
+    ScopeDFG* dfg = isolate->GetScopeDFG(info_, scope_position);
+    if (dfg != NULL) dfg->PropagateTaint(it.frame());
+
+    CallLocator locator(isolate, info_->scope(), expr_position);
+    locator.Locate(info_, info_->literal()->body());
+
+    if (locator.found()) {
+      const ZoneList<Expression*>* t_args = locator.LocatedNode()->arguments();
+
+      for (int i = 0; i < t_args->length(); i++) {
+        ExpressionTaintChecker checker(isolate, locator.LocatedScope(),
+                                       it.frame());
+
+#ifdef DEBUG
+        if (isolate->inRKDebugMode()) {
+          std::cout << "\nPrinting Located Arguments :: " << std::endl;
+          // (t_args->at(i))->Print(isolate);
+          std::cout << std::flush;
+        }
+#endif
+
+        if (checker.Check(t_args->at(i))) {
+          Handle<Object> obj = args.at(i);
+
+          if (obj->IsSmi()) {
+            std::cout << "\nVisitArguments -> VisitAndPushIntoRegisterList "
+                         "didn't perform as expected";
+          }
+
+          if (!obj->IsSmi()) {
+            isolate->SetTaintForV8Object(obj);
+            checker.PopulatePropagatedFrom(obj);
+          }
+        }
+      }
+    }
+  }
+
+  return *backup_obj;
+}
+
+// Discard any stale AST TT and OBJMAP that were left behind by
+// a previous function which wasn't properly cleaned up.
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnFunctionEnter) {
+  // CHECK(args.length() == 0);
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+  // IGNORE_IF_HONEYPAGE(isolate, UNDEFINED_VALUE_HEAP);
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\nRuntime_OnFunctionEnter" << std::endl;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  isolate->DropAstTaintTable(reinterpret_cast<void*>(it.frame()->fp()));
+  isolate->DropObjectMap(reinterpret_cast<void*>(it.frame()->fp()));
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnFunctionExit) {
+  // CHECK(args.length() == 0);
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+  // IGNORE_IF_HONEYPAGE(isolate, UNDEFINED_VALUE_HEAP);
+
+  auto scope_position = args.smi_value_at(1);
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\nRuntime_OnFunctionExit" << std::endl;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+    ParseInfo* info_ = isolate->GetCompilationInfo(function);
+    if (info_ == NULL) return *obj;
+
+    ScopeDFG* dfg = isolate->GetScopeDFG(info_, scope_position);
+    if (dfg != NULL) dfg->PropagateTaint(it.frame());
+  }
+
+  isolate->DropAstTaintTable(reinterpret_cast<void*>(it.frame()->fp()));
+  isolate->DropObjectMap(reinterpret_cast<void*>(it.frame()->fp()));
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnVisitObjectLiteralFast) {
+  //  1st position ... :: Home Object
+  // 2nd position :: scope postion
+  // 3rd position :: expression position :: of object literal
+
+  // CHECK(args.length() == 4);
+
+  // if (!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  // if (args.length() <= 3) return UNDEFINED_VALUE_HEAP;
+
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> home_obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *home_obj);
+
+  auto scope_position = args.smi_value_at(1);
+  auto expr_position = args.smi_value_at(2);
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\n\n~~~~~~~~~~OnVisitObjectLiteralFast~~~~~~~~~~~~~ :: "
+              << args.length();
+    std::cout << "\n1.Home Object:: " << home_obj->ptr() << " :: ";
+    // home_obj->Print();
+    std::cout << "2. Scope Position :: " << scope_position;
+    std::cout << "\n3. Location in AST :: " << expr_position << std::flush;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+    ParseInfo* info_ = isolate->GetCompilationInfo(function);
+    if (info_ == NULL) return *home_obj;
+
+    ScopeDFG* dfg = isolate->GetScopeDFG(info_, scope_position);
+    if (dfg != NULL) dfg->PropagateTaint(it.frame());
+
+    ObjectLiteralLocator locator(isolate, info_->scope(), expr_position);
+    locator.Locate(info_, info_->literal()->body());
+
+    if (locator.found()) {
+      Handle<JSObject> jsobject = Handle<JSObject>::cast(home_obj);
+      ObjectLiteral* expr = locator.LocatedNode();
+      PtrComprCageBase cage_base(isolate);
+      Handle<Map> map(jsobject->map(cage_base), isolate);
+      Handle<Object> property;
+
+      for (InternalIndex i : map->IterateOwnDescriptors()) {
+        Handle<String> key_name;
+        PropertyDetails details = PropertyDetails::Empty();
+        {
+          DisallowGarbageCollection no_gc;
+          DescriptorArray descriptors = map->instance_descriptors(cage_base);
+          Name name = descriptors.GetKey(i);
+
+          if (!name.IsString(cage_base)) continue;
+          key_name = handle(String::cast(name), isolate);
+          details = descriptors.GetDetails(i);
+        }
+
+        if (details.IsDontEnum()) continue;
+        Handle<Object> element;
+        if (details.location() == PropertyLocation::kField &&
+            *map == jsobject->map(cage_base)) {
+          DCHECK_EQ(PropertyKind::kData, details.kind());
+          FieldIndex field_index = FieldIndex::ForDescriptor(*map, i);
+          element = JSObject::FastPropertyAt(
+              isolate, jsobject, details.representation(), field_index);
+        } else {
+          element = Object::GetPropertyOrElement(isolate, jsobject, key_name)
+                        .ToHandleChecked();
+        }
+
+#ifdef DEBUG
+        std::cout << "\nIndex :: " << i.as_int();
+        std::cout << "\nKey Name :: ";
+        // key_name->Print();
+        std::cout << std::flush;
+        std::cout << "\nProperty :: " << element->ptr() << " :: ";
+        // element->Print();
+#endif
+
+        if (i.as_int() >= expr->properties()->length()) return *home_obj;
+
+        ObjectLiteral::Property* property = expr->properties()->at(i.as_int());
+        ExpressionTaintChecker checker(isolate, locator.LocatedScope(),
+                                       it.frame());
+
+        if (checker.Check(property->value())) {
+#ifdef DEBUG
+          std::cout << "\nChecker Found Tainted Property ::\n";
+          // expr->Print(isolate);
+          std::cout << "\n Object at property :: ";
+          // property->value()->Print(isolate);
+          std::cout << "Value :: ";
+          // element->Print();
+#endif
+          isolate->SetTaintForV8Object(element);
+          checker.PopulatePropagatedFrom(element);
+        }
+      }
+    }
+  }
+
+  return *home_obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_SetTaint) {
+  // CHECK(args.length() == 2);
+
+  HandleScope handle_scope(isolate);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, UNDEFINED_VALUE_HEAP);
+
+  Handle<Object> obj = args.at(0);
+
+  obj = FilterInvalidV8Objects(isolate, obj);
+  if (obj.is_null() || obj->IsSmi()) return UNDEFINED_VALUE_HEAP;
+
+  auto position = args.smi_value_at(1);
+
+  JavaScriptStackFrameIterator it(isolate);
+
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  ParseInfo* info_ = isolate->GetCompilationInfo(function);
+
+  if (info_ == NULL) return UNDEFINED_VALUE_HEAP;
+
+  CallLocator locator(isolate, info_->scope(), position);
+  locator.Locate(info_, info_->literal()->body());
+  if (locator.found()) {
+    Call* call = locator.LocatedNode();
+
+    DCHECK(call->expression()->AsProperty()->obj());
+
+    AstNode* target = call->expression()->AsProperty()->obj();
+
+    isolate->SetTaintForV8Object(obj, "manual");
+
+    // |obj| cannot be partially tainted here. Locator is still used
+    // because we don't know what the node type is.
+    isolate->SetTaintForAstNode(function,
+                                reinterpret_cast<void*>(it.frame()->fp()),
+                                target->position(), target->node_type());
+  }
+
+  return UNDEFINED_VALUE_HEAP;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_IsTainted) {
+  // CHECK(args.length() == 3);
+
+  HandleScope handle_scope(isolate);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, UNDEFINED_VALUE_HEAP);
+
+  std::cout << "\nRuntime_IsTainted" << std::endl;
+
+  Handle<Object> obj = args.at(0);
+
+  auto scope_position = args.smi_value_at(1);
+
+  auto expr_position = args.smi_value_at(2);
+
+  obj = FilterInvalidV8Objects(isolate, obj);
+  if (obj.is_null()) return UNDEFINED_VALUE_HEAP;
+
+  // Commented temporarily
+
+  JavaScriptStackFrameIterator it(isolate);
+
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  ParseInfo* info_ = isolate->GetCompilationInfo(function);
+
+  if (info_ == NULL) return UNDEFINED_VALUE_HEAP;
+
+  ScopeDFG* dfg = isolate->GetScopeDFG(info_, scope_position);
+  if (dfg != NULL) dfg->PropagateTaint(it.frame());
+
+  CallLocator locator(isolate, info_->scope(), expr_position);
+  locator.Locate(info_, info_->literal()->body());
+
+  if (locator.found()) {
+    Call* call = locator.LocatedNode();
+    // AstNode* node = call->expression();
+
+    DCHECK(call->expression()->AsProperty()->obj());
+    AstNode* target = call->expression()->AsProperty()->obj();
+
+    VariableProxy* proxy = target->AsVariableProxy();
+
+    std::string proxy_addr =
+        std::to_string(reinterpret_cast<uintptr_t>(proxy->var()));
+
+    std::cout << "\nChecking AST tainted for proxy pointing to :: " << std::hex
+              << proxy_addr;
+
+#ifdef DEBUG
+    // target->Print(isolate);
+#endif
+
+    if (isolate->IsV8ObjectTainted(obj)) {
+      std::cout << "\n:: Final ObjectTaint status :: true";
+      std::cout << "\n :: Source" << isolate->getObjectTaintSource(obj);
+    }
+
+    if (isolate->IsAstNodeTainted(reinterpret_cast<void*>(it.frame()->fp()),
+                                  target->position(), target->node_type())) {
+      std::cout << "\n:: Final AST status :: true";
+      // return isolate->heap()->ToBoolean(true);
+    }
+  }
+
+  return isolate->heap()->ToBoolean(false);
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnBuildVariableLoad) {
+  // CHECK(args.length() == 3);
+
+  // if (!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  // Input :: args[0] :: object to be loaded in variable proxy
+  // args[1] :: location of proxy in AST
+
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+
+  auto expr_position = args.smi_value_at(1);
+  bool tainted_object = false;
+
+  Handle<Object> obj2 = FilterInvalidV8Objects(isolate, obj);
+  if (obj2.is_null()) return *obj;
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\n\nRuntime_OnBuildVariableLoad :: " << args.length();
+    std::cout << "\n1. Object that will be loaded :: " << obj->ptr() << " :: ";
+    obj->Print();
+    std::cout << "2. Location in AST :: " << expr_position << std::flush;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  // normal object
+  if (obj->IsJSReceiver()) {
+    VisV8Context vctx(isolate);
+    VisV8Logger vlog(vctx);
+    Handle<JSReceiver> rcvr = handle(JSReceiver::cast(*obj), isolate);
+    Handle<String> ctor = JSReceiver::GetConstructorName(isolate, rcvr);
+
+    std::string prop_name_str = ctor->ToCString().get();
+    std::string obj_name_str;
+
+    HeapObject hobj = HeapObject::cast(*obj);
+
+    auto itype = hobj.map().instance_type();
+    if ((itype == JS_SPECIAL_API_OBJECT_TYPE) ||
+        (itype == JS_API_OBJECT_TYPE)) {
+      obj_name_str = "Window";
+
+#ifdef DEBUG
+      if (isolate->inRKDebugMode()) {
+        std::cout << "\nLoaded obj prop pair :: "
+                  << obj_name_str + "." + prop_name_str;
+      }
+#endif
+
+      if (isupper(prop_name_str[0])) {
+        prop_name_str[0] = tolower(prop_name_str[0]);
+      }
+
+      if (isolate->IsObjectPropertySource(obj_name_str, prop_name_str)) {
+        vlog.out() << "\nSOURCEPL$";
+        // visv8_to_string(isolate, vlog.out(), *home_object);
+        vlog.out() << '{' << obj_name_str << '}';
+        vlog.out() << ':';
+        // visv8_to_string(isolate, vlog.out(), *(property_name));
+        vlog.out() << '"' << prop_name_str << '"';
+
+#ifdef DEBUG
+        std::cout << "\nObject Property pair is a taint source  :: "
+                  << obj_name_str + "." + prop_name_str;
+#endif
+
+        std::string encoded_source =
+            isolate->encodeNameAndProperty(obj_name_str, prop_name_str);
+        // return_value = FilterInvalidV8Objects(isolate, return_value);
+
+        tainted_object = true;
+
+        isolate->SetTaintForV8Object(obj, encoded_source);
+      }
+    }
+  }
+
+  if (tainted_object || isolate->IsV8ObjectTainted(obj)) {
+    isolate->SetTaintForAstNode(function,
+                                reinterpret_cast<void*>(it.frame()->fp()),
+                                expr_position, AstNode::kVariableProxy);
+  } else {
+    isolate->UntaintAstNode(reinterpret_cast<void*>(it.frame()->fp()),
+                            expr_position, AstNode::kVariableProxy);
+  }
+
+  isolate->AddToObjectMap(reinterpret_cast<void*>(it.frame()->fp()),
+                          expr_position, AstNode::kVariableProxy, obj);
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnBuildVariableAssignment) {
+  // CHECK(args.length() == 3);
+
+  // if (!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  // Input :: args[0] :: object to be loaded in variable proxy
+  // args[1] :: location of proxy in AST
+
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+
+  auto expr_position = args.smi_value_at(1);
+
+  if (obj->IsSmi()) {
+    obj = isolate->factory()->NewHeapNumber(obj->ToSmi().value());
+  }
+
+  Handle<Object> obj2 = FilterInvalidV8Objects(isolate, obj);
+  if (obj2.is_null()) return *obj;
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\nRuntime_OnBuildVariableAssignment :: " << args.length();
+
+    std::cout << "\nObject to be loaded in var proxy :: " << obj->ptr()
+              << " :: ";
+    // obj->Print();
+    std::cout << "Location of proxy in AST :: " << expr_position << std::flush;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  if (isolate->IsV8ObjectTainted(obj)) {
+    isolate->SetTaintForAstNode(function,
+                                reinterpret_cast<void*>(it.frame()->fp()),
+                                expr_position, AstNode::kVariableProxy);
+  } else {
+    isolate->UntaintAstNode(reinterpret_cast<void*>(it.frame()->fp()),
+                            expr_position, AstNode::kVariableProxy);
+  }
+
+  isolate->AddToObjectMap(reinterpret_cast<void*>(it.frame()->fp()),
+                          expr_position, AstNode::kVariableProxy, obj);
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnVisitAssignment) {
+  // CHECK(args.length() == 3);
+
+  // Input :: args[0] :: object to be loaded in the variable proxy
+  // args[1] :: location of proxy in AST
+
+  // if (!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+
+  auto expr_target_position = args.smi_value_at(1);
+  auto expr_position = args.smi_value_at(2);
+  bool tainted_object = false;
+
+  if (obj->IsSmi()) {
+    obj = isolate->factory()->NewHeapNumber(obj->ToSmi().value());
+  }
+
+  Handle<Object> obj2 = FilterInvalidV8Objects(isolate, obj);
+  if (obj2.is_null()) return *obj;
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\n\nRuntime_OnBuildAssignment :: " << args.length();
+    std::cout << "\n1. Object to be loaded in var proxy :: " << obj->ptr()
+              << " :: ";
+    // obj->Print();
+    std::cout << "2. Target Location in AST :: " << expr_target_position
+              << std::flush;
+    std::cout << "3. Expression Location in AST :: " << expr_target_position
+              << std::flush;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+    ParseInfo* info_ = isolate->GetCompilationInfo(function);
+    if (info_ == NULL) return *obj;
+
+    AssignmentLocator locator(isolate, info_->scope(), expr_position);
+    locator.Locate(info_, info_->literal()->body());
+
+    if (locator.found()) {
+#ifdef DEBUG
+      // AstNode* node = locator.LocatedNode();
+      // node->Print(isolate);
+#endif
+      ExpressionTaintChecker checker(isolate, locator.LocatedScope(),
+                                     it.frame());
+      if (checker.Check(locator.LocatedNode()->value())) {
+        tainted_object = true;
+        isolate->SetTaintForV8Object(obj);
+        checker.PopulatePropagatedFrom(obj);
+      }
+    }
+  }
+
+  if (tainted_object || isolate->IsV8ObjectTainted(obj)) {
+    isolate->SetTaintForAstNode(function,
+                                reinterpret_cast<void*>(it.frame()->fp()),
+                                expr_target_position, AstNode::kVariableProxy);
+  } else {
+    isolate->UntaintAstNode(reinterpret_cast<void*>(it.frame()->fp()),
+                            expr_target_position, AstNode::kVariableProxy);
+  }
+
+  isolate->AddToObjectMap(reinterpret_cast<void*>(it.frame()->fp()),
+                          expr_target_position, AstNode::kVariableProxy, obj);
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnVisitNamedPropertyLoad) {
+  // CHECK(args.length() == 3);
+
+  // if(!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  // 1st position :: object coresponding to the named property
+  //  2nd :: Location
+  //  3rd :: Home Object
+  //  4th :: Property Name
+
+  HandleScope handle_scope(isolate);
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+
+  if (obj->IsSmi()) {
+    obj = isolate->factory()->NewHeapNumber(obj->ToSmi().value());
+  }
+
+  Handle<Object> obj2 = FilterInvalidV8Objects(isolate, obj);
+  if (obj2.is_null()) return *obj;
+
+  bool tainted_object = false;
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+  auto expr_position = args.smi_value_at(1);
+  Handle<Object> home_object = args.at(2);
+  Handle<String> property_name = handle(String::cast(*args.at(3)), isolate);
+
+#ifdef DEBUG
+  if (true) {
+    std::cout << "\n\nRuntime_OnVisitNamedPropertyLoad :: " << args.length();
+
+    std::cout << "\n1. Object corresponding to the named property :: "
+              << obj->ptr() << " :: ";
+    // print only if the object is not js function // because of feedback vector
+    // if(!obj->IsJSFunction()) obj->Print();
+
+    std::cout << "2. Location in AST :: " << expr_position << std::flush;
+    std::cout << "\n3. Home Object :: ";
+    // home_object->Print();
+    std::cout << "4. Property name :: ";
+    property_name->Print();
+  }
+#endif
+
+  // normal object
+  if (home_object->IsJSReceiver()) {
+    VisV8Context vctx(isolate);
+    VisV8Logger vlog(vctx);
+    Handle<JSReceiver> rcvr = handle(JSReceiver::cast(*home_object), isolate);
+    Handle<String> ctor = JSReceiver::GetConstructorName(isolate, rcvr);
+
+    std::string obj_name_str = ctor->ToCString().get();
+    std::string prop_name_str = property_name->ToCString().get();
+
+#ifdef DEBUG
+    if (isolate->inRKDebugMode()) {
+      std::cout << "\nLoaded obj prop pair :: "
+                << obj_name_str + "." + prop_name_str;
+    }
+#endif
+
+    if (obj->IsJSFunction()) {
+      // will be handled in property call
+      return *obj;
+    }
+
+    if (isolate->IsObjectPropertySource(obj_name_str, prop_name_str)) {
+      vlog.out() << "\nSOURCEPL$";
+      visv8_to_string(isolate, vlog.out(), *home_object);
+      vlog.out() << ':';
+      visv8_to_string(isolate, vlog.out(), *property_name);
+      // vlog.out() << ':';
+      // visv8_to_string(isolate, vlog.out(), *obj);
+
+#ifdef DEBUG
+      if (isolate->inRKDebugMode()) {
+        std::cout << "\nTaint Source triggered :: "
+                  << obj_name_str + "." + prop_name_str;
+        std::cout << "\nCorresponding Object :: " << obj;
+      }
+#endif
+
+      // calls are handled in propertycall
+
+      tainted_object = true;
+
+      std::string encoded_source =
+          isolate->encodeNameAndProperty(obj_name_str, prop_name_str);
+
+      // std::cout << "\nEncoded:: " << encoded_name_prop << std::flush;
+      isolate->SetTaintForV8Object(obj, encoded_source);
+
+    }
+
+    else if (isolate->IsV8ObjectTainted(home_object)) {
+      tainted_object = true;
+      isolate->SetTaintForV8Object(obj,
+                                   isolate->getObjectTaintSource(home_object));
+      // isolate->SetTaintForAstNode(function,
+      //                             reinterpret_cast<void*>(it.frame()->fp()),
+      //                             expr_position, AstNode::kProperty);
+      // isolate->AddToObjectMap(reinterpret_cast<void*>(it.frame()->fp()),
+      //                         expr_position, AstNode::kProperty, obj);
+      // return *obj;
+    }
+  }
+
+  if (tainted_object || isolate->IsV8ObjectTainted(obj)) {
+    isolate->SetTaintForAstNode(function,
+                                reinterpret_cast<void*>(it.frame()->fp()),
+                                expr_position, AstNode::kProperty);
+
+  } else {
+    isolate->UntaintAstNode(reinterpret_cast<void*>(it.frame()->fp()),
+                            expr_position, AstNode::kProperty);
+  }
+
+  isolate->AddToObjectMap(reinterpret_cast<void*>(it.frame()->fp()),
+                          expr_position, AstNode::kProperty, obj);
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnVisitKeyedPropertyLoad) {
+  // CHECK(args.length() == 3);
+
+  // if(!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  // 1st position :: object coresponding to the keyed property
+  //  2nd :: Location
+  //  3rd :: Home Object
+
+  HandleScope handle_scope(isolate);
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+  bool tainted_object = false;
+
+  if (obj->IsSmi()) {
+    obj = isolate->factory()->NewHeapNumber(obj->ToSmi().value());
+  }
+
+  Handle<Object> obj2 = FilterInvalidV8Objects(isolate, obj);
+  if (obj2.is_null()) return *obj;
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  auto expr_position = args.smi_value_at(1);
+  Handle<Object> home_object = args.at(2);
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\n\nRuntime_OnVisitKeyedPropertyLoad :: " << args.length();
+  }
+#endif
+
+  if (isolate->IsV8ObjectTainted(home_object)) {
+    tainted_object = true;
+
+    isolate->SetTaintForV8Object(obj,
+                                 isolate->getObjectTaintSource(home_object));
+    return *obj;
+  }
+
+  if (tainted_object || isolate->IsV8ObjectTainted(obj)) {
+    isolate->SetTaintForAstNode(function,
+                                reinterpret_cast<void*>(it.frame()->fp()),
+                                expr_position, AstNode::kProperty);
+  } else {
+    isolate->UntaintAstNode(reinterpret_cast<void*>(it.frame()->fp()),
+                            expr_position, AstNode::kProperty);
+  }
+
+  isolate->AddToObjectMap(reinterpret_cast<void*>(it.frame()->fp()),
+                          expr_position, AstNode::kProperty, obj);
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnScopeExit) {
+  // CHECK(args.length() == 3);
+
+  // args[0] :: Accumulator
+  // args[1] :: scope position
+
+  // if (!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  HandleScope handle_scope(isolate);
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+
+  auto scope_position = args.smi_value_at(1);
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\nRuntime_OnScopeExit :: " << args.length();
+    std::cout << "\nScope Position :: " << scope_position;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+    ParseInfo* info_ = isolate->GetCompilationInfo(function);
+    if (info_ == NULL) return *obj;
+
+    ScopeDFG* dfg = isolate->GetScopeDFG(info_, scope_position);
+    if (dfg != NULL) dfg->PropagateTaint(it.frame());
+  }
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnVisitReturnStatement) {
+  // CHECK(args.length() == 3);
+
+  // args[0] :: Object
+  // args[1] :: expression position
+
+  // if (!isolate->ShouldTaintBusiness()) return UNDEFINED_VALUE_HEAP;
+
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> obj = args.at(0);
+  auto scope_position = args.smi_value_at(1);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+
+  if (obj->IsSmi()) {
+    obj = isolate->factory()->NewHeapNumber(obj->ToSmi().value());
+  }
+
+  Handle<Object> obj2 = FilterInvalidV8Objects(isolate, obj);
+  if (obj2.is_null()) return *obj;
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\nRuntime_OnVisitReturnStatement :: " << args.length();
+    std::cout << "\nObject :: ";
+    // obj->Print();
+    std::cout << "Scope Position :: " << scope_position;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+    ParseInfo* info_ = isolate->GetCompilationInfo(function);
+    if (info_ == NULL) return *obj;
+    ReturnStatementLocator locator(isolate, info_->scope(), scope_position);
+    locator.Locate(info_, info_->literal()->body());
+
+    if (locator.found()) {
+      ScopeDFG* dfg =
+          isolate->GetScopeDFG(info_, locator.LocatedScope()->start_position());
+      if (dfg != NULL) dfg->PropagateTaint(it.frame());
+
+      ExpressionTaintChecker checker(isolate, locator.LocatedScope(),
+                                     it.frame());
+      if (checker.Check(locator.LocatedNode()->expression())) {
+        isolate->SetTaintForV8Object(obj);
+        checker.PopulatePropagatedFrom(obj);
+      }
+    }
+  }
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_ReplaceSmiResult) {
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+
+  if (obj->IsSmi()) {
+    obj = isolate->factory()->NewHeapNumber(obj->ToSmi().value());
+  }
+
+  return *obj;
+}
+
+RUNTIME_FUNCTION(Runtime_TaintAnalysis_OnVisitArrayLiteral) {
+  // CHECK(args.length() == 3);
+
+  HandleScope handle_scope(isolate);
+
+  Handle<Object> obj = args.at(0);
+
+  IGNORE_NON_PROPAGATION_CONTEXTS(isolate, true, *obj);
+
+  auto scope_position = args.smi_value_at(1);
+  auto expr_position = args.smi_value_at(2);
+
+  if (obj->IsSmi()) {
+    obj = isolate->factory()->NewHeapNumber(obj->ToSmi().value());
+  }
+
+  Handle<Object> obj2 = FilterInvalidV8Objects(isolate, obj);
+  if (obj2.is_null()) return *obj;
+
+#ifdef DEBUG
+  if (isolate->inRKDebugMode()) {
+    std::cout << "\n\nRuntime_OnVisitArrayLiteral :: " << args.length();
+    std::cout << "\nArray :: " << obj->ptr() << std::endl;
+    // obj->Print();
+    std::cout << "Scope Position :: " << scope_position;
+    std::cout << "\nExpression Position :: " << expr_position << std::flush;
+  }
+#endif
+
+  JavaScriptStackFrameIterator it(isolate);
+  Handle<JSFunction> function(it.frame()->function(), isolate);
+
+  if (isolate->needToPropagate(reinterpret_cast<void*>((it.frame())->fp()))) {
+    ParseInfo* info_ = isolate->GetCompilationInfo(function);
+    if (info_ == NULL) return *obj;
+
+    ScopeDFG* dfg = isolate->GetScopeDFG(info_, scope_position);
+    if (dfg != NULL) dfg->PropagateTaint(it.frame());
+
+    ArrayLiteralLocator locator(isolate, info_->scope(), expr_position);
+    locator.Locate(info_, info_->literal()->body());
+
+    if (locator.found()) {
+      ArrayLiteral* expr = locator.LocatedNode();
+
+#ifdef DEBUG
+      std::cout << "\nArray Literal ::";
+      // expr->Print(isolate);
+#endif
+      Handle<JSArray> receiver = Handle<JSArray>::cast(obj);
+
+      isolate->clear_pending_exception();
+
+      if (!receiver.is_null()) {
+        for (int i = 0; i < expr->values()->length(); i++) {
+          Expression* subexpr = expr->values()->at(i);
+          if (subexpr->IsSpread()) break;
+
+          Handle<Object> element;
+
+          if (subexpr->IsCompileTimeValue()) continue;
+
+          ExpressionTaintChecker checker(isolate, locator.LocatedScope(),
+                                         it.frame());
+          if (checker.Check(subexpr)) {
+            element = (JSReceiver::GetElement(isolate, receiver, i))
+                          .ToHandleChecked();
+
+            element = FilterInvalidV8Objects(isolate, element);
+            // TODO: Can we replace the Smi's here?
+
+            if (!element.is_null() && !element->IsSmi()) {
+              isolate->SetTaintForV8Object(element);
+              checker.PopulatePropagatedFrom(element);
+            }
+          }
+        }
+      }
+    }
+  }
+
+  return *obj;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/src/runtime/runtime-taint.h b/src/runtime/runtime-taint.h
new file mode 100644
index 0000000..06cfd98
--- /dev/null
+++ b/src/runtime/runtime-taint.h
@@ -0,0 +1,1361 @@
+#ifndef V8_RUNTIME_TAINT_H_
+#define V8_RUNTIME_TAINT_H_
+
+#include <iostream>
+
+#include "build/build_config.h"
+#include "src/ast/ast-traversal-visitor.h"
+#include "src/codegen/compiler.h"
+#include "src/commons.h"
+#include "src/debug/debug-scopes.h"
+#include "src/debug/debug.h"
+#include "src/execution/arguments.h"
+#include "src/execution/frames-inl.h"
+#include "src/parsing/parse-info.h"
+#include "src/parsing/parser.h"
+#include "src/runtime/runtime-utils.h"
+
+//  :: includes for vis v8
+
+#include <pthread.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <fstream>
+#include <memory>
+#include <sstream>
+#include <string>
+#include <strstream>
+#include <vector>
+
+#include "src/builtins/builtins-utils.h"
+#include "src/execution/arguments-inl.h"
+#include "src/objects/js-regexp-inl.h"  // VisibleV8: needed to stringify RE objects to logs
+#include "src/objects/keys.h"
+#include "v8-local-handle.h"  // NOLINT(build/include_directory)
+#include "v8-primitive.h"
+
+#if BUILDFLAG(IS_ANDROID)
+#include <sys/prctl.h>
+#endif
+
+namespace v8 {
+namespace internal {
+
+#define KEY_FROM_POSITION_AND_TYPE(pos, type) \
+  reinterpret_cast<void*>(((unsigned long)pos << 12) | ((type << 1) & 0xffe))
+
+static inline Handle<Object> FilterInvalidV8Objects(Isolate* isolate,
+                                                    Handle<Object> obj) {
+  // obj->IsSmi() ||
+
+  if (obj.is_null() || obj->IsSmi() || *obj == Smi::FromInt(0) ||
+      obj->IsUndefined() || *obj == ReadOnlyRoots(isolate).null_value() ||
+      *obj == ReadOnlyRoots(isolate).undefined_value() ||
+      *obj == ReadOnlyRoots(isolate).the_hole_value() ||
+      *obj == ReadOnlyRoots(isolate).true_value() ||
+      *obj == ReadOnlyRoots(isolate).false_value() ||
+      *obj == ReadOnlyRoots(isolate).empty_string()) {
+    return Handle<Object>::null();
+  }
+  return obj;
+}
+
+static inline void PrintJSFunction(Handle<JSFunction> function) {
+  // Handle<SharedFunctionInfo> shared(function->shared());
+  // std::unique_ptr<char[]> name = shared->DebugName()->ToCString();
+  // std::cout << name.get() << ":\n";
+  // if (shared->HasSourceCode()) {
+  //   Handle<String> source(String::cast(
+  //       Script::cast(shared->script())->source()));
+  //   std::string c_source(source->ToCString().get());
+  //   std::cout << c_source.substr(shared->start_position(),
+  //       shared->end_position() - shared->start_position());
+  //   std::cout << "\n\n";
+  // }
+}
+
+class ASTVisitor : public AstVisitor<ASTVisitor> {
+ private:
+  Isolate* isolate_;
+  Scope* scope_;
+
+  ZoneList<Statement*>* scope_statements_;
+
+  uintptr_t stack_limit_;
+
+  // Scope dependencies is used here for collecting all the conditional
+  // statements on which the current scope depends on. For example, if(a) {b;}
+  // else {c;} is a scope, a is the scope_dependencies_.
+  commons::LinkedList scope_dependencies_;
+
+  // dependency scopes contain all the scopes that depend on the conditional
+  // statements in the current scope. For example, if(a) {b;} else {c;} is a
+  // scope, b and c are the dependency_scopes_.
+  commons::LinkedList dependency_scopes_;
+
+ public:
+  ASTVisitor(Isolate* isolate, Scope* scope)
+      : isolate_(isolate),
+        scope_(scope),
+        scope_statements_(NULL),
+        stack_limit_(stack_limit_ = isolate->stack_guard()->real_climit()) {}
+
+  virtual ~ASTVisitor() {}
+
+  Isolate* isolate() const { return isolate_; }
+
+  Scope* scope() const { return scope_; }
+
+  ZoneList<Statement*>* scope_statements() { return scope_statements_; }
+
+  commons::LinkedList* scope_dependencies() { return &scope_dependencies_; }
+
+  commons::LinkedList* dependency_scopes() { return &dependency_scopes_; }
+
+  class EnterScope {
+   private:
+    ASTVisitor* visitor_;
+    Scope* saved_scope_;
+    ZoneList<Statement*>* saved_statements_;
+
+   public:
+    EnterScope(ASTVisitor* visitor, Scope* scope,
+               ZoneList<Statement*>* statements)
+        : visitor_(visitor) {
+      saved_scope_ = visitor_->scope_;
+      saved_statements_ = visitor_->scope_statements_;
+
+      visitor_->scope_ = scope;
+      visitor_->scope_statements_ = statements;
+      visitor_->NotifyScopeEntry();
+    }
+
+    EnterScope(ASTVisitor* visitor, Scope* scope, Expression* expr)
+        : visitor_(visitor) {
+      saved_scope_ = visitor_->scope_;
+      saved_statements_ = visitor->scope_statements_;
+
+      visitor_->scope_ = scope;
+      visitor_->scope_statements_ = NULL;
+      visitor_->NotifyScopeEntry();
+    }
+
+    ~EnterScope() {
+      visitor_->scope_ = saved_scope_;
+      visitor_->scope_statements_ = saved_statements_;
+    }
+  };
+
+  virtual void Visit(AstNode* node) {
+    while (GetCurrentStackPosition() < stack_limit_) {
+      // Increase limit by 1 MiB.
+      isolate_->stack_guard()->SetStackLimit(stack_limit_ - (0x1 << 20));
+      stack_limit_ = isolate_->stack_guard()->real_climit();
+    }
+
+    GENERATE_AST_VISITOR_SWITCH()
+  }
+
+  // Assuming |statements| are in the same scope the visitor
+  // was initialized with.
+  virtual void StartVisit(ZoneList<Statement*>* statements) {
+    EnterScope enter_scope(this, scope_, statements);
+    AstVisitor::VisitStatements(statements);
+  }
+
+  virtual void StartVisit(Expression* expr) {
+    EnterScope enter_scope(this, scope_, expr);
+    // expr->Print(isolate());
+    Visit(expr);
+  }
+
+  //
+  // Declarations.
+  //
+
+  virtual void VisitVariableDeclaration(VariableDeclaration* decl) {}
+
+  virtual void VisitFunctionDeclaration(FunctionDeclaration* decl) {}
+
+  //
+  // Statements.
+  //
+
+  virtual void VisitBlock(Block* block) {
+    if (block->scope() != NULL && ShouldEnterScope()) {
+      EnterScope enter_scope(this, block->scope(), block->statements());
+      VisitStatements(block->statements());
+    } else {
+      // |block| is part of the current scope, visit normally.
+      VisitStatements(block->statements());
+    }
+  }
+
+  virtual void VisitExpressionStatement(ExpressionStatement* stmt) {
+    Visit(stmt->expression());
+  }
+
+  virtual void VisitEmptyStatement(EmptyStatement* stmt) {}
+
+  virtual void VisitSloppyBlockFunctionStatement(
+      SloppyBlockFunctionStatement* stmt) {
+    // Do nothing; don't visit nested function definitions.
+  }
+
+  virtual void VisitIfStatement(IfStatement* stmt) {
+    scope_dependencies_.append(stmt->condition(), NULL);
+    dependency_scopes_.append(scope(), NULL);
+    Visit(stmt->condition());
+    Visit(stmt->then_statement());
+    if (stmt->HasElseStatement()) Visit(stmt->else_statement());
+    scope_dependencies_.pop_tail();
+    dependency_scopes_.pop_tail();
+  }
+
+  virtual void VisitContinueStatement(ContinueStatement* stmt) {}
+  virtual void VisitBreakStatement(BreakStatement* stmt) {}
+
+  virtual void VisitReturnStatement(ReturnStatement* stmt) {
+    Visit(stmt->expression());
+  }
+
+  virtual void VisitWithStatement(WithStatement* stmt) {
+    Visit(stmt->expression());
+    if ((stmt->scope() != NULL) && ShouldEnterScope()) {
+      Zone* zone = stmt->scope()->zone();
+      // TODO: Memory overhead, what if entered multiple times?
+      ZoneList<Statement*>* statements =
+          zone->New<ZoneList<Statement*>>(1, zone);
+
+      statements->Add(stmt->statement(), zone);
+
+      EnterScope enter_scope_(this, stmt->scope(), statements);
+      Visit(stmt->statement());
+    }
+  }
+
+  virtual void VisitSwitchStatement(SwitchStatement* stmt) {
+    scope_dependencies_.append(stmt->tag(), NULL);
+    dependency_scopes_.append(scope(), NULL);
+    Visit(stmt->tag());
+    ZoneList<CaseClause*>* cases = stmt->cases();
+    for (int i = 0; i < cases->length(); i++) {
+      if (!cases->at(i)->is_default()) Visit(cases->at(i)->label());
+      VisitStatements(cases->at(i)->statements());
+    }
+    scope_dependencies_.pop_tail();
+    dependency_scopes_.pop_tail();
+  }
+
+  virtual void VisitDoWhileStatement(DoWhileStatement* stmt) {
+    scope_dependencies_.append(stmt->cond(), NULL);
+    dependency_scopes_.append(scope(), NULL);
+    Visit(stmt->cond());
+    Visit(stmt->body());
+    scope_dependencies_.pop_tail();
+    dependency_scopes_.pop_tail();
+  }
+
+  virtual void VisitWhileStatement(WhileStatement* stmt) {
+    scope_dependencies_.append(stmt->cond(), NULL);
+    dependency_scopes_.append(scope(), NULL);
+    Visit(stmt->cond());
+    Visit(stmt->body());
+    scope_dependencies_.pop_tail();
+    dependency_scopes_.pop_tail();
+  }
+
+  virtual void VisitForStatement(ForStatement* stmt) {
+    if (stmt->cond() != NULL) {
+      scope_dependencies_.append(stmt->cond(), NULL);
+      dependency_scopes_.append(scope(), NULL);
+    }
+
+    if (stmt->init() != NULL) Visit(stmt->init());
+    if (stmt->cond() != NULL) Visit(stmt->cond());
+    Visit(stmt->body());
+    if (stmt->next() != NULL) Visit(stmt->next());
+
+    if (stmt->cond() != NULL) {
+      scope_dependencies_.pop_tail();
+      dependency_scopes_.pop_tail();
+    }
+  }
+
+  virtual void VisitForInStatement(ForInStatement* stmt) {
+    Visit(stmt->each());
+    Visit(stmt->subject());
+    Visit(stmt->body());
+  }
+
+  virtual void VisitForOfStatement(ForOfStatement* stmt) {
+    Visit(stmt->each());
+    Visit(stmt->subject());
+    Visit(stmt->body());
+  }
+
+  virtual void VisitTryCatchStatement(TryCatchStatement* stmt) {
+    Visit(stmt->try_block());
+    if ((stmt->scope() != NULL) && ShouldEnterScope()) {
+      Zone* zone = stmt->scope()->zone();
+      // TODO: Memory overhead, what if entered multiple times?
+      ZoneList<Statement*>* statements =
+          zone->New<ZoneList<Statement*>>(1, zone);
+
+      // ZonePtrList<Statement>* statements;
+
+      statements->Add(stmt->catch_block(), zone);
+
+      EnterScope enter_scope(this, stmt->scope(), statements);
+
+      Visit(stmt->catch_block());
+    }
+  }
+
+  virtual void VisitTryFinallyStatement(TryFinallyStatement* stmt) {
+    Visit(stmt->try_block());
+    Visit(stmt->finally_block());
+  }
+
+  virtual void VisitDebuggerStatement(DebuggerStatement* stmt) {}
+
+  //
+  // Expressions.
+  //
+
+  virtual void VisitFunctionLiteral(FunctionLiteral* literal) {}
+
+  virtual void VisitClassLiteral(ClassLiteral* literal) {}
+
+  virtual void VisitNativeFunctionLiteral(NativeFunctionLiteral* literal) {}
+
+  virtual void VisitConditional(Conditional* cond) {
+    Visit(cond->condition());
+    Visit(cond->then_expression());
+    Visit(cond->else_expression());
+  }
+
+  virtual void VisitVariableProxy(VariableProxy* proxy) {}
+
+  virtual void VisitLiteral(Literal* literal) {}
+
+  virtual void VisitRegExpLiteral(RegExpLiteral* literal) {}
+
+  virtual void VisitObjectLiteral(ObjectLiteral* literal) {
+    for (int i = 0; i < literal->properties()->length(); i++) {
+      ObjectLiteral::Property* property = literal->properties()->at(i);
+      Visit(property->key());
+      Visit(property->value());
+    }
+  }
+
+  virtual void VisitArrayLiteral(ArrayLiteral* literal) {
+    VisitExpressions(literal->values());
+  }
+
+  virtual void VisitAssignment(Assignment* expr) {
+    // std::cout << " =========================== ";
+    // std::cout << "Inside VisitAssignment in runtime-taint.h";
+    // std::cout << " =========================== ";
+
+    // expr->Print(isolate());
+    // std::cout << std::flush;
+
+    Visit(expr->target());
+    Visit(expr->value());
+  }
+
+  virtual void VisitYield(Yield* expr) {
+    Visit(expr->expression());
+    // Visit(expr->generator_object());
+  }
+
+  virtual void VisitThrow(Throw* expr) { Visit(expr->exception()); }
+
+  virtual void VisitProperty(Property* prop) {
+    Visit(prop->obj());
+    Visit(prop->key());
+  }
+
+  virtual void VisitCall(Call* call) {
+    Visit(call->expression());
+    VisitExpressions(call->arguments());
+  }
+
+  virtual void VisitCallNew(CallNew* call) {
+    Visit(call->expression());
+    VisitExpressions(call->arguments());
+  }
+
+  virtual void VisitCallRuntime(CallRuntime* call) {
+    VisitExpressions(call->arguments());
+  }
+
+  virtual void VisitUnaryOperation(UnaryOperation* expr) {
+    Visit(expr->expression());
+  }
+
+  virtual void VisitCountOperation(CountOperation* expr) {
+    Visit(expr->expression());
+  }
+
+  virtual void VisitBinaryOperation(BinaryOperation* expr) {
+    // std::cout << " =========================== ";
+    // std::cout << " Inside VisitBinaryOperation ";
+    // std::cout << " =========================== ";
+
+    Visit(expr->left());
+    Visit(expr->right());
+  }
+
+  virtual void VisitNaryOperation(NaryOperation* expr) {
+    // std::cout << " =========================== ";
+    // std::cout << " VisitNaryOperationCalled ";
+    // std::cout << " =========================== ";
+
+    Visit(expr->first());
+    for (size_t i = 0; i < expr->subsequent_length(); ++i)
+      Visit(expr->subsequent(i));
+  }
+
+  virtual void VisitCompareOperation(CompareOperation* comp) {
+    Visit(comp->left());
+    Visit(comp->right());
+  }
+
+  /* TODO: Esoteric stuff. I'll handle later. */
+  virtual void VisitSpread(Spread* expr) {}
+
+  virtual void VisitSuperPropertyReference(SuperPropertyReference* expr) {}
+  virtual void VisitSuperCallReference(SuperCallReference* expr) {}
+  virtual void VisitCaseClause(CaseClause* expr) {}
+  virtual void VisitEmptyParentheses(EmptyParentheses* expr) {}
+  virtual void VisitInitializeClassMembersStatement(
+      InitializeClassMembersStatement* node) {}
+  virtual void VisitInitializeClassStaticElementsStatement(
+      InitializeClassStaticElementsStatement* node) {}
+  virtual void VisitAwait(Await* expr) { Visit(expr->expression()); }
+  virtual void VisitCompoundAssignment(CompoundAssignment* expr) {
+    VisitAssignment(expr);
+  }
+  virtual void VisitGetTemplateObject(GetTemplateObject* node) {}
+  virtual void VisitImportCallExpression(ImportCallExpression* expr) {}
+  virtual void VisitOptionalChain(OptionalChain* node) {}
+  virtual void VisitTemplateLiteral(TemplateLiteral* node) {}
+  virtual void VisitThisExpression(ThisExpression* expr) {}
+  virtual void VisitYieldStar(YieldStar* expr) { Visit(expr->expression()); }
+
+ protected:
+  virtual void NotifyScopeEntry() {}
+  virtual bool ShouldEnterScope() { return true; }
+};
+
+class ScopeLocator : public ASTVisitor {
+ public:
+  ScopeLocator(Isolate* isolate, Scope* scope, int position)
+      : ASTVisitor(isolate, scope),
+        position_(position),
+        found_(false),
+        located_scope_(NULL),
+        located_scope_statements_(NULL) {}
+
+  void Locate(ZoneList<Statement*>* statements) { StartVisit(statements); }
+
+  bool found() const { return found_; }
+
+  Scope* LocatedScope() { return located_scope_; }
+
+  ZoneList<Statement*>* LocatedScopeStatements() {
+    return located_scope_statements_;
+  }
+
+  commons::LinkedList* scope_dependencies() { return &scope_dependencies_; }
+
+  commons::LinkedList* dependency_scopes() { return &dependency_scopes_; }
+
+ private:
+  void NotifyScopeEntry() {
+    if (scope()->start_position() == position_) {
+      found_ = true;
+      located_scope_ = scope();
+      located_scope_statements_ = scope_statements();
+      // Make a copy of the current scope dependencies.
+      scope_dependencies_ = *(ASTVisitor::scope_dependencies());
+      dependency_scopes_ = *(ASTVisitor::dependency_scopes());
+    }
+  }
+
+  void Visit(AstNode* node) {
+    if (located_scope_ != NULL) return;
+    ASTVisitor::Visit(node);
+  }
+
+  int position_;
+  bool found_;
+  Scope* located_scope_;
+  ZoneList<Statement*>* located_scope_statements_;
+  commons::LinkedList scope_dependencies_;
+  commons::LinkedList dependency_scopes_;
+};
+
+struct ScopeAndNode {
+  Scope* scope;
+  AstNode* node;
+};
+
+class AstNodeLocator : public ASTVisitor {
+ private:
+  int position_;
+  bool found_;
+  AstNode* located_node_;
+  Scope* located_scope_;
+
+ public:
+  AstNodeLocator(Isolate* isolate, Scope* scope, int position)
+      : ASTVisitor(isolate, scope),
+        position_(position),
+        found_(false),
+        located_node_(NULL),
+        located_scope_(NULL) {}
+
+  void Visit(AstNode* node) {
+    if (node->position() == position_ && IsNodeType(node)) {
+      found_ = true;
+      located_node_ = node;
+      located_scope_ = scope();
+      return;
+    }
+    ASTVisitor::Visit(node);
+  }
+
+  void Locate(ParseInfo* info, ZoneList<Statement*>* statements) {
+    found_ = false;
+    ScopeAndNode* cached =
+        isolate()->LocatedScopeAndNode(info, node_type(), position_);
+
+    if (cached != NULL) {
+      found_ = true;
+      located_node_ = cached->node;
+      located_scope_ = cached->scope;
+    } else {
+      StartVisit(statements);
+      if (found_) {
+        cached = new ScopeAndNode;
+        cached->scope = located_scope_;
+        cached->node = located_node_;
+        isolate()->AddLocatedScopeAndNode(info, node_type(), position_, cached);
+      }
+    }
+
+    // StartVisit(statements);
+  }
+
+  bool found() const { return found_; }
+
+  AstNode* LocatedNode() { return located_node_; }
+
+  Scope* LocatedScope() { return located_scope_; }
+
+ protected:
+  virtual bool IsNodeType(AstNode* node) = 0;
+  virtual AstNode::NodeType node_type() = 0;
+};
+
+#define SPECIALIZE_AST_NODE_LOCATOR(name)                                     \
+  class name##Locator : public AstNodeLocator {                               \
+   public:                                                                    \
+    name##Locator(Isolate* isolate, Scope* scope, int position)               \
+        : AstNodeLocator(isolate, scope, position) {}                         \
+    name* LocatedNode() { return AstNodeLocator::LocatedNode()->As##name(); } \
+                                                                              \
+   private:                                                                   \
+    bool IsNodeType(AstNode* node) { return node->Is##name(); }               \
+    AstNode::NodeType node_type() { return AstNode::k##name; }                \
+  };
+
+SPECIALIZE_AST_NODE_LOCATOR(Call)
+SPECIALIZE_AST_NODE_LOCATOR(Assignment)
+SPECIALIZE_AST_NODE_LOCATOR(ReturnStatement)
+SPECIALIZE_AST_NODE_LOCATOR(Property)
+SPECIALIZE_AST_NODE_LOCATOR(ArrayLiteral)
+SPECIALIZE_AST_NODE_LOCATOR(ObjectLiteral)
+SPECIALIZE_AST_NODE_LOCATOR(VariableProxy)
+SPECIALIZE_AST_NODE_LOCATOR(CallRuntime)
+
+#undef SPECIALIZE_AST_NODE_LOCATOR
+
+class ScopeDFG {
+ private:
+  Isolate* isolate_;
+  Scope* scope_;
+
+  // Adjacency list (contains "from" node to "to" node) [all the nodes
+  // irrespective of the taint status]
+  commons::HashTable nodes_;
+
+  // Taint propagation.
+  JavaScriptFrame* frame_;
+
+  // contains the list of nodes that have been visited
+  commons::HashTable* visited_;
+
+  // List of key value pairs for which the key is tainted
+  commons::LinkedList* list_;
+
+  // maybe these two can be ommitted
+  void* propagated_from_;
+  Handle<Object> propagated_from_obj_;
+
+  std::string source_info;
+  // bool propagated_;
+
+  // Contains the duplicate AST taint table for the function under analysis
+  commons::HashTable* ast_taint_table_;
+
+ public:
+  ScopeDFG(Isolate* isolate, Scope* scope) : isolate_(isolate), scope_(scope) {}
+
+  static void IterateScopeDFGDestructor(void* key, void* value, void* data) {
+    delete (commons::HashTable*)value;
+  }
+
+  ~ScopeDFG() { nodes_.iterate(IterateScopeDFGDestructor, NULL); }
+
+  void print() {}
+
+  Isolate* isolate() const { return isolate_; }
+
+  Scope* scope() const { return scope_; }
+
+  void AddEdge(AstNode* from, AstNode* to) {
+#ifdef DEBUG
+    if (true) {
+      std::cout << "\nEdge added from " << from->position() << " :: type :: ";
+      printType(from->node_type());
+      std::cout << " -- TO --> " << to->position() << " :: type :: ";
+      printType(to->node_type());
+
+      std::cout << "\n----------------------------**-------------------------";
+      std::cout << "\nFrom Node : \n";
+      from->Print(isolate());
+      std::cout << "\n\t\t\t||";
+      std::cout << "\n\t\t\t\\/";
+      std::cout << "\nTo Node : \n";
+      to->Print(isolate());
+      std::cout << "----------------------------**------------------------\n";
+    }
+#endif
+
+    CHECK(from != to);
+    commons::HashTable* adj_list =
+        reinterpret_cast<commons::HashTable*>(nodes_.get(from));
+
+    if (adj_list == NULL) {
+      adj_list = new commons::HashTable();
+      nodes_.insert(from, adj_list);
+    }
+
+    adj_list->insert(to, NULL);
+  }
+
+  void printType(int type) {
+    if (type == AstNode::kVariableProxy) {
+      std::cout << "VariableProxy";
+    } else if (type == AstNode::kProperty) {
+      std::cout << "Property";
+    } else if (type == AstNode::kCall) {
+      std::cout << "Call";
+    } else {
+      std::cout << "Unknown";
+    }
+    std::cout << " (" << type << ") " << std::flush;
+  }
+
+  static void IteratePropagateTaint(void* key, void* value, void* data) {
+    // key is the from node, value is the adjacency list, data is dfg
+#ifdef DEBUG
+    std::cout << "\n\n-------- IteratePropagateTaint ------";
+#endif
+    ScopeDFG* dfg = (ScopeDFG*)data;
+
+    Isolate* isolate = dfg->isolate_;
+
+    //  :: maybe sus
+    HandleScope scope(isolate);
+    // Scope* scope = dfg->scope_;
+    JavaScriptFrame* frame = dfg->frame_;
+
+    void* fp = reinterpret_cast<void*>(frame->fp());
+
+    Handle<JSFunction> function(frame->function(), isolate);
+
+    AstNode* node = reinterpret_cast<AstNode*>(key);
+
+    Handle<Object> obj(
+        isolate->LookupObjectMap(fp, node->position(), node->node_type()),
+        isolate);
+
+    // DCHECK(node->IsVariableProxy());
+    obj = FilterInvalidV8Objects(isolate, obj);
+
+    // if (!obj.is_null() && !isolate->IsDoNotTaint(obj)) {
+    //   if (obj->IsSmi()) {
+    //     // TODO: Replace Smi.
+    //   }
+
+    // std::cout<<"\nOriginal Source :: "<<original_source;
+
+    if (!obj.is_null()) {
+      std::string si = dfg->source_info;
+#ifdef DEBUG
+      if (true) {
+        if (dfg->propagated_from_obj_.is_null())
+          std::cout << "\nFrom AST NODE: ";
+        else
+          std::cout << "\nTo AST NODE: ";
+        node->Print(isolate);
+        std::cout << "Corresponding object" << obj << std::flush;
+        std::cout << "\nSource Info :: " << si;
+      }
+#endif
+
+      // if (!dfg->propagated_from_obj_.is_null()) {
+      // AstNode* from = reinterpret_cast<AstNode*>(dfg->propagated_from_);
+
+      // Handle<Object> from_obj = dfg->propagated_from_obj_;
+
+      // Object si = isolate->getObjectTaintSource(from_obj);
+
+      // std::string si_str = (String::cast(si)).ToCString().get();
+
+      // Handle<Object> str =
+      //     isolate->factory()->NewStringFromAsciiChecked(si.c_str());
+
+      isolate->SetTaintForV8Object(obj, si);
+
+      // isolate->AddPropagatedFrom(obj, function, from, from_obj);
+      // }
+
+      //   // This will also set taint for the AST node if obj is
+      //   // an Smi and was not replaced above - desired behavior.
+      //   if (!isolate->IsV8ObjectPartiallyTainted(obj)) {
+      isolate->SetTaintForAstNode(function, fp, node->position(),
+                                  node->node_type());
+    }
+
+    if (dfg->visited_->search(key)) return;
+
+    dfg->visited_->insert(key, NULL);
+
+    //   }
+
+    commons::HashTable* adj_list =
+        reinterpret_cast<commons::HashTable*>(dfg->nodes_.get(key));
+
+    // contains all the neighbors of the node represented by key
+    if (adj_list != NULL) {
+      void* saved_from = dfg->propagated_from_;
+      Handle<Object> saved_from_obj = dfg->propagated_from_obj_;
+      std::string saved_source_info = dfg->source_info;
+
+      dfg->propagated_from_ = key;
+      dfg->propagated_from_obj_ = obj;
+      dfg->source_info = isolate->getObjectTaintSource(obj);
+
+      adj_list->iterate(IteratePropagateTaint, data);
+
+      dfg->propagated_from_ = saved_from;
+      dfg->propagated_from_obj_ = saved_from_obj;
+      dfg->source_info = saved_source_info;
+    }
+#ifdef DEBUG
+    std::cout << "\n ----------------------\n";
+#endif
+  }
+
+  static void IteratePopulateTaintedNodes(void* key, void* value, void* data) {
+    // key is the from node, value is the adj list, data is scopedfg
+    ScopeDFG* dfg = reinterpret_cast<ScopeDFG*>(data);
+    AstNode* node = reinterpret_cast<AstNode*>(key);
+    // int node_type = node->node_type();
+
+    void* mapped_key =
+        KEY_FROM_POSITION_AND_TYPE(node->position(), node->node_type());
+
+#ifdef DEBUG
+    std::cout << "\n++++++++IteratePopulateTaintedNodes+++++++";
+    std::cout << " \nIterating for node : \n";
+    node->Print(dfg->isolate());
+    std::cout << "Position :: " << node->position()
+              << " type :: " << (int)node->node_type();
+#endif
+
+    // if the from node is tainted, then that node alongwith adjacency list is
+    // added to the list
+    if (dfg->ast_taint_table_->search(mapped_key)) {
+#ifdef DEBUG
+      std::cout
+          << "\nNode is tainted :: adding adjacency list to the tainted list";
+#endif
+      dfg->list_->append(key, value);
+    }
+  }
+
+  bool PropagateTaint(JavaScriptFrame* frame) {
+    // Handle<JSFunction> function(frame->function(), isolate());
+    // std::cout<<"\nPT";
+
+if(!isolate_->needToPropagate(reinterpret_cast<void*>(frame->fp()))) return false;
+
+#ifdef DEBUG
+    std::cout << "\n\nPropagating Taint" << std::endl;
+#endif
+
+    commons::HashTable* ast_taint_table =
+        isolate_->GetAstTaintTable(reinterpret_cast<void*>(frame->fp()), false);
+
+    if (ast_taint_table == NULL) {
+#ifdef DEBUG
+      std::cout << "\nNO AST NODE TAINTED :: NULL TAINT TABLE\n";
+#endif
+      return false;
+    }
+
+    // // Need to make a copy - cannot iterate on the AST taint table itself!
+    // //
+    // // Also filter out nodes that are not in the DFG.
+    list_ = new commons::LinkedList();
+
+    ast_taint_table_ = ast_taint_table;
+
+    // nodes_ contain key(ast node :: from) value (adjacency list :: to) pair
+    // fills in list the value of those ast nodes for which the key is tainted
+    // in AST taint table (not in object taint table)
+    nodes_.iterate(IteratePopulateTaintedNodes, this);
+    // equivalent to :: for all element in nodes table (from , to)
+    // IteratePopulateTaintedNodes(from, to , scopedfg)
+
+    frame_ = frame;
+    visited_ = new commons::HashTable();
+    propagated_from_ = NULL;
+    propagated_from_obj_ = Handle<Object>::null();
+    source_info = "";
+
+    // List now contains key, value pair for which the key is tainted in AST
+    // taint table.
+    list_->iterate(IteratePropagateTaint, this);
+
+    delete visited_;
+    delete list_;
+
+    // we don't need to propagate unless a node is added to AST taint list
+    isolate_->setNeedToPropagate(reinterpret_cast<void*>(frame->fp()), false);
+    return true;
+  }
+};
+
+class RHSCollector : public ASTVisitor {
+ private:
+  commons::LinkedList* output_;
+
+ public:
+  RHSCollector(Isolate* isolate, Scope* scope) : ASTVisitor(isolate, scope) {}
+
+  void Collect(AstNode* node, commons::LinkedList* output) {
+    output_ = output;
+    Visit(node);
+  }
+
+  void VisitVariableProxy(VariableProxy* proxy) {
+    output_->append(proxy, NULL);
+  }
+
+  void VisitProperty(Property* property) { output_->append(property, NULL); }
+
+  void VisitCall(Call* call) { output_->append(call, NULL); }
+};
+
+class ScopeDFGBuilder : public ASTVisitor {
+ private:
+  // Collect data flows: RHS -> LHS.
+  enum VisitFor { NONE, LHS, RHS };
+
+  ScopeDFG* dfg_;
+  bool nested_property_;
+  VisitFor visit_for_;
+  VisitFor control_visit_for_;
+  commons::LinkedList rhs_;
+  commons::LinkedList lhs_;
+  commons::LinkedList control_rhs_;
+  commons::LinkedList control_lhs_;
+
+  // Contains a from the if (a) { b; } else { c; } statement.
+  commons::LinkedList scope_dependencies_;
+
+ public:
+  ScopeDFGBuilder(Isolate* isolate, Scope* scope,
+                  commons::LinkedList* scope_dependencies,
+                  commons::LinkedList* dependency_scopes)
+      : ASTVisitor(isolate, scope),
+        nested_property_(false),
+        visit_for_(NONE),
+        control_visit_for_(NONE) {
+    CHECK(scope_dependencies->size() == dependency_scopes->size());
+
+    if (!scope_dependencies->empty()) {
+      // Make a copy, don't operate on the original lists.
+      commons::LinkedList dependencies(*scope_dependencies);
+      commons::LinkedList scopes(*dependency_scopes);
+
+      while (!dependencies.empty()) {
+        AstNode* node = (AstNode*)dependencies.head_key();
+        // node->Print(isolate);
+        Scope* scope = (Scope*)scopes.head_key();
+        RHSCollector collector(isolate, scope);
+        collector.Collect(node, &scope_dependencies_);
+
+        dependencies.pop_head();
+        scopes.pop_head();
+      }
+    }
+  }
+
+  ScopeDFG* Build(ZoneList<Statement*>* statements) {
+#ifdef DEBUG
+    std::cout << "\n\n!!!!!ScopeDFGBuilder::Building DFG!!!!";
+#endif
+    nested_property_ = false;
+    dfg_ = new ScopeDFG(isolate(), scope());
+    StartVisit(statements);
+#ifdef DEBUG
+    std::cout << "\n!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!";
+#endif
+    return dfg_;
+  }
+
+  /*
+   * Control dependencies.
+   */
+
+  void VisitIfStatement(IfStatement* stmt) {
+    // std::cout << "VisiteIfStatement" << std::endl;
+
+    ControlVisitForRHS(stmt->condition());
+    ControlVisitForLHS(stmt->then_statement());
+
+    if (stmt->HasElseStatement())
+      ControlVisitForLHS(stmt->else_statement(), false);
+    PopulateControlDFGEdges();
+  }
+
+  void VisitWhileStatement(WhileStatement* stmt) {
+    ControlVisitForRHS(stmt->cond());
+    ControlVisitForLHS(stmt->body());
+    PopulateControlDFGEdges();
+  }
+
+  void VisitForStatement(ForStatement* stmt) {
+    if (stmt->init() != NULL) Visit(stmt->init());
+
+    if (stmt->cond() != NULL) {
+      ControlVisitForRHS(stmt->cond());
+      ControlVisitForLHS(stmt->body());
+      if (stmt->next() != NULL) ControlVisitForLHS(stmt->next(), false);
+      PopulateControlDFGEdges();
+    } else {
+      Visit(stmt->body());
+      if (stmt->next() != NULL) Visit(stmt->next());
+    }
+  }
+
+  void VisitDoWhileStatement(DoWhileStatement* stmt) {
+    ControlVisitForRHS(stmt->cond());
+    ControlVisitForLHS(stmt->body());
+    PopulateControlDFGEdges();
+  }
+
+  void VisitSwitchStatement(SwitchStatement* stmt) {
+    ControlVisitForRHS(stmt->tag());
+
+    bool first = true;
+    for (int i = 0; i < stmt->cases()->length(); i++) {
+      CaseClause* clause = stmt->cases()->at(i);
+      for (int j = 0; j < clause->statements()->length(); j++) {
+        ControlVisitForLHS(clause->statements()->at(j), first);
+        first = false;
+      }
+    }
+
+    PopulateControlDFGEdges();
+  }
+
+  void VisitConditional(Conditional* expr) {
+    ControlVisitForRHS(expr->condition());
+    ControlVisitForLHS(expr->then_expression());
+    ControlVisitForLHS(expr->else_expression(), false);
+    PopulateControlDFGEdges();
+  }
+
+  // Not sure about these.
+
+  void VisitForInStatement(ForInStatement* stmt) {
+    // // Does nothing due to how we handle Property.
+    ASTVisitor::VisitForInStatement(stmt);
+  }
+
+  void VisitForOfStatement(ForOfStatement* stmt) {
+    // // Does nothing due to how we handle arrays.
+    ASTVisitor::VisitForOfStatement(stmt);
+  }
+
+  void VisitWithStatement(WithStatement* stmt) {
+    // // I don't know WTF this is, seems irrelevant.
+    ASTVisitor::VisitWithStatement(stmt);
+  }
+
+  void VisitTryCatchStatement(TryCatchStatement* stmt) {
+    // // What if a tainted object is thrown?
+    ASTVisitor::VisitTryCatchStatement(stmt);
+  }
+
+  /*
+   * Data dependencies.
+   */
+
+  //  :: Need to modify this
+
+  void VisitAssignment(Assignment* expr) {
+    // std::cout << " =========================== ";
+    // std::cout << " Inside VisitAssignment ";
+    // std::cout << " =========================== ";
+    // // JQueryRHSChecker checker(isolate(), scope());
+
+    // expr->Print(isolate());
+    // std::cout << std::flush;
+
+    VisitForRHS(expr->value());
+    VisitForLHS(expr->target());
+
+    // std::cout << "\n Inside visit assignment : \n";
+    // expr->Print(isolate());
+    // std::cout << "\n";
+    PopulateDFGEdges();
+  }
+
+  /*
+   * Terminal nodes, they are either RHS or LHS.
+   */
+
+  void VisitVariableProxy(VariableProxy* proxy) { RecordVisitedAstNode(proxy); }
+
+  void VisitProperty(Property* property) {
+    RecordVisitedAstNode(property);
+
+    bool saved_nested_property = nested_property_;
+    nested_property_ = true;
+    ASTVisitor::Visit(property->obj());
+    nested_property_ = saved_nested_property;
+  }
+
+  void VisitCall(Call* call) {
+    RecordVisitedAstNode(call);
+    ASTVisitor::VisitExpressions(call->arguments());
+  }
+
+  // Do nothing for compound types (already handled dynamically).
+  void VisitObjectLiteral(ObjectLiteral* expr) {}
+
+  void VisitArrayLiteral(ArrayLiteral* expr) {}
+
+ private:
+  bool ShouldEnterScope() { return false; }
+
+  static void IteratePushControlLHS(void* key, void* value, void* data) {
+    commons::LinkedList* lhs = (commons::LinkedList*)key;
+    AstNode* node = (AstNode*)data;
+    lhs->append(node, NULL);
+  }
+
+  void RecordVisitedAstNode(AstNode* node) {
+    if (node->IsLiteral() && !nested_property_)
+      CHECK(node->AsLiteral()->IsPropertyName());
+
+    if (visit_for_ == RHS)
+      CurrentRHS()->append(node, NULL);
+
+    else if (visit_for_ == LHS && !nested_property_)
+      CurrentLHS()->append(node, NULL);
+
+    if (control_visit_for_ == RHS) {
+      CurrentControlRHS()->append(node, NULL);
+    } else if (control_visit_for_ == LHS && visit_for_ == LHS &&
+               !nested_property_) {
+      control_lhs_.iterate(IteratePushControlLHS, node);
+    }
+  }
+
+  void ControlVisitForRHS(AstNode* node) {
+    commons::LinkedList* rhs = new commons::LinkedList();
+    control_rhs_.prepend(rhs, NULL);
+
+    VisitFor saved_visit_for = control_visit_for_;
+    control_visit_for_ = RHS;
+    Visit(node);
+    control_visit_for_ = saved_visit_for;
+  }
+
+  void ControlVisitForLHS(AstNode* node, bool push_new = true) {
+    if (push_new) {
+      commons::LinkedList* lhs = new commons::LinkedList();
+      control_lhs_.prepend(lhs, NULL);
+    }
+
+    VisitFor saved_visit_for = control_visit_for_;
+    control_visit_for_ = LHS;
+    Visit(node);
+    control_visit_for_ = saved_visit_for;
+  }
+
+  void VisitForRHS(AstNode* node) {
+    commons::LinkedList* rhs = new commons::LinkedList();
+    rhs_.prepend(rhs, NULL);
+
+    VisitFor saved_visit_for = visit_for_;
+    visit_for_ = RHS;
+    Visit(node);
+    visit_for_ = saved_visit_for;
+  }
+
+  void VisitForLHS(AstNode* node) {
+    commons::LinkedList* lhs = new commons::LinkedList();
+    lhs_.prepend(lhs, NULL);
+
+    VisitFor saved_visit_for = visit_for_;
+    visit_for_ = LHS;
+    Visit(node);
+    visit_for_ = saved_visit_for;
+  }
+
+  struct IterateData {
+    void* data;
+    ScopeDFGBuilder* builder;
+  };
+
+  static void IterateLHS(void* key, void* value, void* data) {
+    IterateData* lhs_data = (IterateData*)data;
+    AstNode* lhs_node = (AstNode*)key;
+    commons::LinkedList* rhs = (commons::LinkedList*)lhs_data->data;
+
+    IterateData rhs_data = {lhs_node, lhs_data->builder};
+    rhs->iterate(IterateRHS, &rhs_data);
+  }
+
+  static void IterateRHS(void* key, void* value, void* data) {
+    AstNode* rhs_node = (AstNode*)key;
+    IterateData* rhs_data = (IterateData*)data;
+    AstNode* lhs_node = (AstNode*)rhs_data->data;
+    rhs_data->builder->dfg_->AddEdge(rhs_node, lhs_node);
+  }
+
+  void PopulateDFGEdges() {
+    commons::LinkedList* rhs = CurrentRHS();
+    commons::LinkedList* lhs = CurrentLHS();
+
+    if (!rhs->empty() && !lhs->empty()) {
+      IterateData data = {rhs, this};
+      lhs->iterate(IterateLHS, &data);
+    }
+
+    if (!scope_dependencies_.empty() && !lhs->empty()) {
+      IterateData data = {&scope_dependencies_, this};
+      lhs->iterate(IterateLHS, &data);
+    }
+
+    rhs_.remove(rhs);
+    lhs_.remove(lhs);
+    delete rhs;
+    delete lhs;
+  }
+
+  void PopulateControlDFGEdges() {
+    commons::LinkedList* rhs = CurrentControlRHS();
+    commons::LinkedList* lhs = CurrentControlLHS();
+
+    IterateData data = {rhs, this};
+    lhs->iterate(IterateLHS, &data);
+
+    control_rhs_.remove(rhs);
+    control_lhs_.remove(lhs);
+    delete rhs;
+    delete lhs;
+  }
+
+  commons::LinkedList* CurrentControlRHS() {
+    return reinterpret_cast<commons::LinkedList*>(control_rhs_.head_key());
+  }
+
+  commons::LinkedList* CurrentControlLHS() {
+    return reinterpret_cast<commons::LinkedList*>(control_lhs_.head_key());
+  }
+
+  commons::LinkedList* CurrentRHS() {
+    return reinterpret_cast<commons::LinkedList*>(rhs_.head_key());
+  }
+
+  commons::LinkedList* CurrentLHS() {
+    return reinterpret_cast<commons::LinkedList*>(lhs_.head_key());
+  }
+};
+
+class ExpressionTaintChecker : public ASTVisitor {
+ public:
+  ExpressionTaintChecker(Isolate* isolate, Scope* scope, JavaScriptFrame* frame)
+      : ASTVisitor(isolate, scope), tainted_(false), frame_(frame) {}
+
+  bool Check(Expression* expr) {
+// function_ = Handle<JSFunction>(frame_->function(), isolate());
+#ifdef DEBUG
+    std::cout << "\nChecking Expression taint for :: \n";
+    expr->Print(isolate());
+    std::cout << std::flush;
+#endif
+
+    tainted_ = false;
+    tainted_nodes_.clear();
+    ASTVisitor::StartVisit(expr);
+    return tainted_;
+  }
+
+  void PopulatePropagatedFrom(Handle<Object> obj) {
+    obj = FilterInvalidV8Objects(isolate(), obj);
+    if (obj.is_null()) return;
+
+    // function_ = Handle<JSFunction>(frame_->function(), isolate());
+    obj_ = obj;
+
+    tainted_nodes_.iterate(IteratePopulatePropagatedFrom, this);
+  }
+
+  void VisitLiteral(Literal* literal) {
+    // TODO: Can we have a property name here?
+
+    // Handle<Object> obj = literal->BuildValue(isolate());
+
+    // if(!obj->IsStrongOrWeak()) return;
+
+    // if (!literal->IsPropertyName() &&
+    // !IsCodeSpaceObject(HeapObject::cast(*obj)) &&
+    //     isolate()->IsV8ObjectTainted(obj)) {
+    //   tainted_ = true;
+    //   tainted_nodes_.append(literal, NULL);
+    // }
+  }
+
+  void VisitVariableProxy(VariableProxy* proxy) {
+    if (isolate()->IsAstNodeTainted(reinterpret_cast<void*>(frame_->fp()),
+                                    proxy->position(),
+                                    AstNode::kVariableProxy)) {
+      tainted_ = true;
+      tainted_nodes_.append(proxy, NULL);
+    }
+  }
+
+  void VisitProperty(Property* property) {
+    if (isolate()->IsAstNodeTainted(reinterpret_cast<void*>(frame_->fp()),
+                                    property->position(), AstNode::kProperty)) {
+      tainted_ = true;
+      tainted_nodes_.append(property, NULL);
+    }
+    ASTVisitor::Visit(property->obj());
+  }
+
+  void VisitCall(Call* expr) {
+    if (isolate()->IsAstNodeTainted(reinterpret_cast<void*>(frame_->fp()),
+                                    expr->position(), AstNode::kCall)) {
+      tainted_ = true;
+      tainted_nodes_.append(expr, NULL);
+    }
+    ASTVisitor::VisitExpressions(expr->arguments());
+  }
+
+  // Do nothing for compound types (already handled dynamically).
+  void VisitObjectLiteral(ObjectLiteral* expr) {}
+  void VisitArrayLiteral(ArrayLiteral* expr) {}
+
+ private:
+  bool ShouldEnterScope() { return false; }
+
+  static void IteratePopulatePropagatedFrom(void* key, void* value,
+                                            void* data) {
+
+
+
+    AstNode* node = (AstNode*)key;
+    ExpressionTaintChecker* checker = (ExpressionTaintChecker*)data;
+    Isolate* isolate = checker->isolate();
+
+    HandleScope handle_scope(isolate);
+    // Scope* scope = checker->scope();
+    // Handle<JSFunction> function = checker->function_;
+    void* fp = reinterpret_cast<void*>(checker->frame_->fp());
+
+    Handle<Object> obj = checker->obj_;
+    Handle<Object> from_obj;
+    std::string from_source_str;
+
+#ifdef DEBUG
+    std::cout << "\nPopulating Taint from ::";
+    node->Print(isolate);
+#endif
+
+    if (node->IsLiteral()) {
+      // from_obj = node->AsLiteral()->BuildValue(isolate);
+      // from_obj = FilterInvalidV8Objects(isolate, from_obj);
+      // isolate->AddPropagatedFrom(obj, function, node, from_obj);
+
+#ifdef DEBUG
+      std::cout << "\nNODE is Literal";
+#endif
+    } else if (node->IsVariableProxy()) {
+      VariableProxy* proxy = node->AsVariableProxy();
+      from_obj =
+          Handle<Object>(isolate->LookupObjectMap(fp, proxy->position(),
+                                                  AstNode::kVariableProxy),
+                         isolate);
+
+      from_source_str = isolate->getObjectTaintSource(from_obj);
+      isolate->SetTaintForV8Object(obj, from_source_str);
+      // isolate->AddPropagatedFrom(obj, function, proxy, from_obj);
+    } else if (node->IsProperty()) {
+      Property* property = node->AsProperty();
+      from_obj =
+          Handle<Object>(isolate->LookupObjectMap(fp, property->position(),
+                                                  AstNode::kProperty),
+                         isolate);
+      from_source_str = isolate->getObjectTaintSource(from_obj);
+      isolate->SetTaintForV8Object(obj, from_source_str);
+      // isolate->AddPropagatedFrom(obj, function, property, from_obj);
+    } else if (node->IsCall()) {
+      from_obj = Handle<Object>(
+          isolate->LookupObjectMap(fp, node->position(), AstNode::kCall),
+          isolate);
+      from_source_str = isolate->getObjectTaintSource(from_obj);
+      isolate->SetTaintForV8Object(obj, from_source_str);
+      // isolate->AddPropagatedFrom(obj, function, node, from_obj);
+    }
+  }
+
+  bool tainted_;
+  commons::LinkedList tainted_nodes_;
+  JavaScriptFrame* frame_;
+
+  Handle<JSFunction> function_;
+  Handle<Object> obj_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif
diff --git a/src/runtime/runtime.h b/src/runtime/runtime.h
index f860538..4fd51ad 100644
--- a/src/runtime/runtime.h
+++ b/src/runtime/runtime.h
@@ -771,7 +771,29 @@ namespace internal {
   FOR_EACH_INTRINSIC_TYPEDARRAY(F, I)               \
   IF_WASM(FOR_EACH_INTRINSIC_WASM, F, I)            \
   IF_WASM(FOR_EACH_INTRINSIC_WASM_TEST, F, I)       \
-  FOR_EACH_INTRINSIC_WEAKREF(F, I)
+  FOR_EACH_INTRINSIC_WEAKREF(F, I)                  \
+  FOR_EACH_INTRINSIC_TAINT_ANALYSIS(F, I)
+
+//  :: Added taint analysis runtime functions
+
+#define FOR_EACH_INTRINSIC_TAINT_ANALYSIS(F, I)     \
+  F(TaintAnalysis_IsTainted, -1, 1)                 \
+  F(TaintAnalysis_SetTaint, -1, 1)                  \
+  F(TaintAnalysis_JustPrintArgs, -1, 1)             \
+  F(TaintAnalysis_OnVisitNamedPropertyLoad, -1, 1)  \
+  F(TaintAnalysis_OnVisitKeyedPropertyLoad, -1, 1)  \
+  F(TaintAnalysis_OnBuildVariableAssignment, -1, 1) \
+  F(TaintAnalysis_OnBuildVariableLoad, -1, 1)       \
+  F(TaintAnalysis_OnVisitAssignment, -1, 1)         \
+  F(TaintAnalysis_OnScopeExit, -1, 1)               \
+  F(TaintAnalysis_OnFunctionExit, -1, 1)               \
+  F(TaintAnalysis_OnVisitReturnStatement, -1, 1)    \
+  F(TaintAnalysis_OnVisitCallArguments, -1, 1)      \
+  F(TaintAnalysis_OnVisitPropertyCall, -1, 1)       \
+  F(TaintAnalysis_OnFunctionEnter, -1, 1)           \
+  F(TaintAnalysis_ReplaceSmiResult, -1, 1)          \
+  F(TaintAnalysis_OnVisitArrayLiteral, -1, 1)       \
+  F(TaintAnalysis_OnVisitObjectLiteralFast, -1, 1)
 
 // Defines the list of all intrinsics, coming in 2 flavors, either returning an
 // object or a pair.