nelmio/alice — pull request #18 by jubianchi (2013-01-02 17:34:00+00:00)
Title: Secure object instanciation

We had some problem with the recent commit which introduces objects instanciation with constructor bypassing.

The object are always created using the deserialization hack but in some cases (when the constructor has no args or no required args.

This can lead to object inconsistency, especially when there are properties initialized inside this method.

I secured the way the instanciation is done by:
* Using reflection to check if the object is instanciable without args
* Using the ```\ReflectionClass::newInstanceWithoutConstructor``` if we have PHP 5.4+
* Using the deserialization as a fallback in other cases

The main drawback to me is that the use of reflection could decrease perfs.