I'm still not convinced we should callnewInstance() on arbitrary attributes. Do we have a way to whitelist relevant attributes beforehand? Note that this is more or less what the now-deprecatedArgumentInterface did for us.

Alternatively: Can we make thenewInstance() call lazy, so we only perform it if$argumentMetadata->getAttributes(MyAttribute::class) is called?

Sure, we could use some closures for that. But is it really worth it? Instantiation should not be heavy...

It shouldn't. Still, we triggerautoloading and attribute validation and execute someone else's code here. The reflection API intentionally gives us a way to prevent this. Why shouldn't we use it?

Well, the autoloading will get triggered anyway when usinggetAttributes inIS_INSTANCEOF mode since we have an argument resolver in Symfony that does that it will be triggered anyway.

You are right, autoloading might be triggered anyway if we useIS_INSTANCEOF.

The scope of the argument value resolver covers Symfony controllers exclusively.
Controllers are auto-registered callables that are executed at runtime, which might use third-party extensions we don't even know about. I mean, we do run someone else's code all the time in this area (take e.g sensio/framework-extra-bundle param converters... reflection-based logic is way more heavy there.)

So, after thinking twice at the possible alternatives, I propose to keep this PR as-is and iterate.
If someone comes up with a problematic case, we can reconsider pretty easily.

I propose to keep this PR as-is and iterate.

👍🏻 We agree on the goal of the PR and discuss an implementation detail here. Let's merge and I'll try to create a follow-up PR to avoid unwantednewInstance() calls.

If someone comes up with a problematic case, we can reconsider pretty easily.

Sorry for being so persistent here. I'd like to avoid the problematic case before the bugfix becomes a BC break.