[C++] DenseUnionArray::Make ignores the offset and length of a sliced value_offsets array #54937

Describe the bug, including details regarding any error messages, version, and platform.

DenseUnionArray::Make(type_ids, value_offsets, children, ...) builds the union from the raw buffers of type_ids and value_offsets and uses type_ids.offset() as the offset of the union array for both buffers. The offset and the length of value_offsets are never looked at, so:

• If value_offsets is sliced differently from type_ids, the union reads the value offsets from the wrong positions. ValidateFull() does not notice because the offsets that are read are still valid offsets into the children.
• If value_offsets is shorter than type_ids, Make succeeds and the union reads past the logical end of value_offsets (into whatever the backing buffer holds).

Reproducer (C++, current main 373d64c):

auto type_ids = ArrayFromJSON(int8(), "[0, 0]");
auto child = ArrayFromJSON(int64(), "[10, 20, 30]");
auto value_offsets = ArrayFromJSON(int32(), "[0, 1, 2]")->Slice(1, 2);   // logically [1, 2]
auto arr = DenseUnionArray::Make(*type_ids, *value_offsets, {child}).ValueOrDie();
// expected [20, 30], actual [10, 20]; arr->ValidateFull() is OK

auto short_offsets = ArrayFromJSON(int32(), "[0, 1]")->Slice(0, 1);      // length 1
DenseUnionArray::Make(*type_ids, *short_offsets, {child});               // succeeds, should be Invalid

Same root cause as GH-54907 (SparseUnionArray::Make and sliced type_ids), found while fixing that issue. Proposed fix: reject a value_offsets array shorter than type_ids and slice both buffers to their logical windows (zero-copy) so the union can be built with offset 0.

Component(s)

C++