Merge branch '2.7' into 2.8

* 2.7:
  [Twig+FrameworkBundle] Fix forward compat with Form 2.8
  [2.6] Static Code Analysis for Components
  [Security/Http] Fix test relying on a private property
  [Serializer] Fix bugs reported in symfony/symfony@b5990be#commitcomment-12301266

Conflicts:
	src/Symfony/Bridge/Twig/Resources/views/Form/form_div_layout.html.twig
	src/Symfony/Bundle/FrameworkBundle/Resources/views/Form/widget_attributes.html.php
	src/Symfony/Component/Security/Http/Tests/Firewall/AnonymousAuthenticationListenerTest.php

Author: nicolas-grekas

Normalizer/AbstractNormalizer.php

@@ -291,7 +291,7 @@ protected function prepareForDenormalization($data)
      *
      * @throws RuntimeException
      */
-    protected function instantiateObject(array $data, $class, array &$context, \ReflectionClass $reflectionClass, $allowedAttributes)
+    protected function instantiateObject(array &$data, $class, array &$context, \ReflectionClass $reflectionClass, $allowedAttributes)
     {
         if (
             isset($context['object_to_populate']) &&

Normalizer/GetSetMethodNormalizer.php

@@ -102,6 +102,7 @@ public function denormalize($data, $class, $format = null, array $context = arra
         $reflectionClass = new \ReflectionClass($class);
         $object = $this->instantiateObject($normalizedData, $class, $context, $reflectionClass, $allowedAttributes);
 
+        $classMethods = get_class_methods($object);
         foreach ($normalizedData as $attribute => $value) {
             if ($this->nameConverter) {
                 $attribute = $this->nameConverter->denormalize($attribute);
@@ -113,7 +114,7 @@ public function denormalize($data, $class, $format = null, array $context = arra
             if ($allowed && !$ignored) {
                 $setter = 'set'.ucfirst($attribute);
 
-                if (method_exists($object, $setter)) {
+                if (in_array($setter, $classMethods)) {
                     $object->$setter($value);
                 }
             }

Tests/Normalizer/GetSetMethodNormalizerTest.php

@@ -228,6 +228,12 @@ public function testConstructorWithObjectDenormalize()
         $this->assertEquals('bar', $obj->getBar());
     }
 
+    public function testConstructorWArgWithPrivateMutator()
+    {
+        $obj = $this->normalizer->denormalize(array('foo' => 'bar'), __NAMESPACE__.'\ObjectConstructorArgsWithPrivateMutatorDummy', 'any');
+        $this->assertEquals('bar', $obj->getFoo());
+    }
+
     public function testGroupsNormalize()
     {
         $classMetadataFactory = new ClassMetadataFactory(new AnnotationLoader(new AnnotationReader()));
@@ -511,15 +517,21 @@ public function testObjectToPopulate()
     public function testDenormalizeNonExistingAttribute()
     {
         $this->assertEquals(
-            new PropertyDummy(),
-            $this->normalizer->denormalize(array('non_existing' => true), __NAMESPACE__.'\PropertyDummy')
+            new GetSetDummy(),
+            $this->normalizer->denormalize(array('non_existing' => true), __NAMESPACE__.'\GetSetDummy')
         );
     }
 
     public function testNoTraversableSupport()
     {
         $this->assertFalse($this->normalizer->supportsNormalization(new \ArrayObject()));
     }
+
+    public function testPrivateSetter()
+    {
+        $obj = $this->normalizer->denormalize(array('foo' => 'foobar'), __NAMESPACE__.'\ObjectWithPrivateSetterDummy');
+        $this->assertEquals('bar', $obj->getFoo());
+    }
 }
 
 class GetSetDummy
@@ -726,3 +738,37 @@ public function getBar_foo()
         return $this->bar_foo;
     }
 }
+
+class ObjectConstructorArgsWithPrivateMutatorDummy
+{
+    private $foo;
+
+    public function __construct($foo)
+    {
+        $this->setFoo($foo);
+    }
+
+    public function getFoo()
+    {
+        return $this->foo;
+    }
+
+    private function setFoo($foo)
+    {
+        $this->foo = $foo;
+    }
+}
+
+class ObjectWithPrivateSetterDummy
+{
+    private $foo = 'bar';
+
+    public function getFoo()
+    {
+        return $this->foo;
+    }
+
+    private function setFoo($foo)
+    {
+    }
+}