[C++][Compute] ascii_upper / ascii_lower / ascii_swapcase return an invalid array when the first offset is not 0 #54906

Describe the bug, including details regarding any error messages, version, and platform.

ascii_upper, ascii_lower and ascii_swapcase return an invalid array when the input has offset == 0 but its first value offset is not 0. Such an input is valid. The format only says that the first offset is generally 0, and ValidateFull() accepts the input.

Reproducer (pyarrow 26.0.0 from PyPI, Python 3.12, Windows 11):

import struct
import pyarrow as pa
import pyarrow.compute as pc

offsets = pa.py_buffer(struct.pack("<3i", 5, 8, 8))
data = pa.py_buffer(b"xxxxxabc")
arr = pa.Array.from_buffers(pa.string(), 2, [None, offsets, data])
arr.validate(full=True)   # OK
print(arr.to_pylist())    # ['abc', '']

out = pc.ascii_upper(arr)
out.validate(full=True)
# pyarrow.lib.ArrowInvalid: Offset invariant failure: offset for slot 1 out of bounds: 8 > 3

Expected: ['ABC', ''].

• The same happens with ascii_lower and ascii_swapcase, and with large_string input.
• utf8_upper and utf8_lower are not affected.

The cause is in StringDataTransform (scalar_string_ascii.cc):

• When input.offset == 0, the input offsets buffer is reused unchanged.
• The transformed data, however, is written to a new buffer of offsets[length] - offsets[0] bytes, starting at position 0.
• So the reused offsets (5, 8, 8) point past the end of the 3-byte output data.

Reusing the offsets is only correct when offsets[0] == 0. Otherwise the existing else branch, which rebases the offsets by offsets[0], gives the right result.

This was found with an AI-assisted analysis of the C++ code against the columnar format specification. The reproducer above was run against pyarrow 26.0.0.

Component(s)

C++