Abstract Instantiation

ID

php.abstract_instantiation

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

error-handling, reliability

Description

Reports a new X(…​) expression where X is an abstract class declared in the same file. Resolution is limited to the current file, so the rule only fires when it can see the abstract declaration; the pseudo-types self, static and parent are ignored because they resolve at runtime to the concrete called class.

Rationale

An abstract class is an incomplete contract: it declares methods it does not implement, so it cannot be a working object on its own. PHP enforces this at runtime by raising a fatal error Cannot instantiate abstract class X the moment the new is reached. The failure aborts the request and is easy to introduce when a base type is used where a concrete subclass was meant. Flagging the instantiation statically turns a runtime crash into a build-time finding.

<?php
abstract class Shape
{
    abstract public function area(): float;
}

class Circle extends Shape
{
    public function area(): float { return 3.14; }
}

$a = new Shape();   // FLAW — fatal: cannot instantiate abstract class Shape
$b = new Circle();  // OK — concrete subclass

Remediation

Instantiate a concrete subclass that implements the abstract methods, or, if the type was meant to be instantiable, remove the abstract modifier and supply the missing method bodies.

References