napi_get_typedarray_info panics on a Float16Array (entered unreachable code)

[hexbinoct]

Version: Deno 2.9.5 (also reproduces on canary 2.9.5+33ff918)

Passing a Float16Array to a native addon that calls napi_get_typedarray_info on it kills the process with a Rust panic. Float16Array has been enabled by default in Deno since 2.2 (#28320), so any script can construct one and hand it to any addon that inspects typed arrays; the element-type chain in napi_get_typedarray_info (ext/napi/js_native_api.rs) has no float16 arm and ends in unreachable!().

Related, in the same file: napi_create_typedarray with napi_float16_array falls through to napi_invalid_arg. Node 24 creates the array (napi_float16_array is element type 11). Returning an error there is at least survivable, but it is a conformance gap against Node, and the two functions should agree once a float16 arm exists.

Minimal repro, one C file plus a driver:

addon.c

#include <node_api.h>

/* value of napi_float16_array; spelled numerically so the repro builds
 * against older headers too */
#define FLOAT16_TYPE ((napi_typedarray_type)11)

static napi_value type_of(napi_env env, napi_callback_info info) {
  size_t argc = 1;
  napi_value ta;
  napi_get_cb_info(env, info, &argc, &ta, NULL, NULL);
  napi_typedarray_type type;
  size_t length;
  napi_status s =
      napi_get_typedarray_info(env, ta, &type, &length, NULL, NULL, NULL);
  napi_value out;
  napi_create_int32(env, s == napi_ok ? (int)type : -(int)s, &out);
  return out;
}

static napi_value create_f16(napi_env env, napi_callback_info info) {
  napi_value ab;
  void* data;
  napi_create_arraybuffer(env, 16, &data, &ab);
  napi_value ta;
  napi_status s = napi_create_typedarray(env, FLOAT16_TYPE, 8, ab, 0, &ta);
  if (s == napi_ok) return ta;
  napi_value out;
  napi_create_int32(env, -(int)s, &out);
  return out;
}

NAPI_MODULE_INIT() {
  napi_value fn;
  napi_create_function(env, "typeOf", NAPI_AUTO_LENGTH, type_of, NULL, &fn);
  napi_set_named_property(env, exports, "typeOf", fn);
  napi_create_function(env, "createF16", NAPI_AUTO_LENGTH, create_f16, NULL, &fn);
  napi_set_named_property(env, exports, "createF16", fn);
  return exports;
}

repro3.cjs

const addon = require('./repro3.node');

// Sanity: a classic element type works everywhere (7 = napi_float32_array).
console.log('typeOf(Float32Array) ->', addon.typeOf(new Float32Array(4)));

// napi_create_typedarray with napi_float16_array (11).
console.log('createF16() ->', addon.createF16());

// The crash: napi_get_typedarray_info on a Float16Array.
console.log('typeOf(Float16Array) ->', addon.typeOf(new Float16Array(4)));

Build and run (Linux, headers from a Node install, here the node:24-bookworm Docker image):

gcc -shared -fPIC -o repro3.node addon.c -I/usr/local/include/node
node repro3.cjs
deno run -A repro3.cjs

Node v24.18.1 (exit 0):

typeOf(Float32Array) -> 7
createF16() -> Float16Array(8) [
  0, 0, 0, 0,
  0, 0, 0, 0
]
typeOf(Float16Array) -> 11

Deno 2.9.5 (exit code 1):

typeOf(Float32Array) -> 7
createF16() -> -1

============================================================
Deno has panicked. This is a bug in Deno. Please report this
at https://github.com/denoland/deno/issues/new.
If you can reliably reproduce this panic, include the
reproduction steps and the stack trace URL below in your report.

Platform: linux x86_64
Version: 2.9.5
Args: ["/opt/deno-stable/deno", "run", "-A", "repro3.cjs"]

View stack trace at:
https://panic.deno.com/v2.9.5/x86_64-unknown-linux-gnu/k6m9xF-19m1D0r9m1Dik9m1Dwj9m1Dqgu-0D8m2-0Ds1ggyFylz-xFk-m1_Bgv36hCio36hCs326hC8j16hCw7u6hCw-s6hCw5n6hCo2l6hCko-ygCi94ygCijtl9B8lhl9Bq98k9Bw6gg8Bum2_7B4l2_7Bikw_7B

thread 'main' (206) panicked at ext/napi/js_native_api.rs:3844:7:
internal error: entered unreachable code
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Canary 2.9.5+33ff918 panics the same way at ext/napi/js_native_api.rs:3859:7 (same unreachable!(), the file shifted a few lines).

Tested on:

• Linux x86_64 (Debian bookworm, Docker): Deno 2.9.5 stable and canary 2.9.5+33ff918 panic; Node v24.18.1 handles both calls.
• Windows 11 x86_64: Deno 2.9.5 panics identically (ext\napi\js_native_api.rs:3844:7). On Windows the addon was built with MSVC as part of the test suite below, and loading it in Deno currently requires the deno executable to be copied to a file named node.exe so the DLL import resolves; that loader quirk is unrelated to this bug.

Expected: napi_get_typedarray_info reports napi_float16_array like Node, and ideally napi_create_typedarray accepts it too. Failing that, an unknown element type should produce an error status; unreachable!() on a value plain JavaScript can create means any addon that inspects typed arrays is one user-supplied Float16Array away from a process kill.

This surfaced while running the Node-API conformance test suite (https://github.com/nodejs/node-api-cts) against Deno; js-native-api/test_typedarray/test.js crashes on it.