GH-51042: [Python] Reject invalid Arrow wrapper types

[1fanwang]

Rationale for this change

Passing the wrong Arrow wrapper type to several PyArrow APIs can terminate Python before an application can catch an error. Acero declaration sequences also accepted floats and null elements, which could abort the process while copying native declarations.

Fixes #51042.

What changes are included in this PR?

The affected Parquet, sparse tensor, Substrait, compute-option, and Acero entry points reject invalid wrapper objects before using them in native calls.

Are these changes tested?

The remaining Acero cases were reproduced in separate processes with a 20-second timeout on native Arrow 26.0.0-SNAPSHOT. Rebuilding the same extension with the type check changes both failures to TypeError. The in-process regression also covers null elements; existing declaration tests exercise valid native execution plans.

Raw logs

$ python -c 'import pyarrow.acero as acero; acero.Declaration.from_sequence([0.0])'
Before:
libc++abi: terminating due to uncaught exception of type std::length_error: vector
returncode=-6
After:
TypeError: Expected a Declaration
returncode=1

$ python -c 'import pyarrow.acero as acero; acero.Declaration.from_sequence([None])'
Before:
returncode=-11
After:
TypeError: Expected a Declaration
returncode=1

$ cd python
$ python -m pytest pyarrow/tests/test_acero.py -k declaration -q
.....                                                                    [100%]
5 passed, 16 deselected, 1 warning in 0.17s

Are there any user-facing changes?

Invalid wrapper arguments raise TypeError instead of terminating Python. Valid declaration sequences still execute normally.

New Contributor's Guide |
Contributing Overview |
AI-generated Code Guidance

• GitHub Issue: [Python] Several APIs segfault instead of rejecting arguments of the wrong type #51042

[github-actions]

⚠️ GitHub issue #51042 has been automatically assigned in GitHub to PR creator.

[Copilot]

🟢 Approval recommended

The changes directly address the reported segfaults by enforcing wrapper-type validation at the Cython boundary and add targeted regression tests for each affected API.

Pull request overview

This PR hardens several PyArrow entry points (Parquet read options, sparse tensor conversion, Substrait serialization, and compute IndexOptions) against invalid wrapper arguments that previously could propagate null native pointers into C++ and crash the interpreter; invalid inputs now raise TypeError instead.

Changes:

• Add explicit wrapper-type validation for Parquet binary_type in both dataset and parquet reader paths.
• Enforce Tensor, Schema, and Scalar wrapper types at key Cython boundaries (sparse from_tensor, Substrait serialization, and IndexOptions).
• Add focused regression tests covering the previously-crashing invalid inputs.

File summaries

File	Description
python/pyarrow/_parquet.pyx	Reject non-DataType binary_type before unwrapping and native calls.
python/pyarrow/_dataset_parquet.pyx	Reject non-DataType binary_type in ParquetReadOptions setter.
python/pyarrow/_compute.pyx	Require Scalar for IndexOptions / _set_options to prevent invalid unwraps.
python/pyarrow/tensor.pxi	Require Tensor for sparse from_tensor conversions across sparse tensor types.
python/pyarrow/_substrait.pyx	Require Schema for Substrait serialize_schema / serialize_expressions.
python/pyarrow/tests/test_dataset.py	Add regression test for ParquetReadOptions(binary_type=0) raising TypeError.
python/pyarrow/tests/parquet/test_parquet_file.py	Add regression test for ParquetFile(..., binary_type=0) raising TypeError.
python/pyarrow/tests/test_compute.py	Add regression test for IndexOptions(0) raising TypeError.
python/pyarrow/tests/test_sparse_tensor.py	Add regression test ensuring sparse from_tensor(0) raises TypeError.
python/pyarrow/tests/test_substrait.py	Add regression tests for Substrait serialization rejecting invalid schema inputs.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[AlenkaF]

Thanks, the PR looks good to me.

Might you be willing to grep the Cython bindings more broadly for the same pattern? (also commented on #51161 (review)).

[1fanwang]

Thanks, the PR looks good to me.

Might you be willing to grep the Cython bindings more broadly for the same pattern? (also commented on #51161 (review)).

Thanks @AlenkaF

Swept the rest of the Cython bindings for the same pattern. Passing None to every public module-level callable across the main modules turned up one reachable crash, dataset.get_partition_keys, which killed the interpreter with a bus error. Filed as #51293 and fixed in #51294.

That PR also adds a guard test so the class stays covered: it passes None to each public callable in a child process and fails naming the offender if the interpreter dies by signal. Most typed parameters handle None deliberately, so it asserts that nothing crashes rather than requiring not None everywhere.

[AlenkaF]

Thanks. I think the only missing thing from the connected issue is acero.Declaration.from_sequence([0.0]) case, then this can be merged.

[github-actions]

⚠️ GitHub issue #51042 has been automatically assigned in GitHub to PR creator.

[Copilot]

🟡 Changes recommended

_acero.pyx still lacks validation for Declaration.__init__ inputs, leaving an invalid-wrapper crash path unresolved.

Get a fresh assessment by requesting another Copilot review.

Review details

• Files reviewed: 12/12 changed files
• Comments generated: 1
• Review effort level: Lite

[1fanwang]

Done in d2cd124.