GH-51043: [Python] Reject null required Arrow objects

[1fanwang]

Rationale for this change

Passing None to several required PyArrow object arguments can dereference a null C++ pointer and terminate the Python process. These calls should reject invalid input with TypeError, consistent with other typed PyArrow APIs.

Fixes #51043.

What changes are included in this PR?

Required Schema, FileFormat, and DataType arguments now reject None at the Cython boundary. FileSystemDataset also rejects a None fragment before unwrapping it.

Are these changes tested?

The reported calls were run in separate Python processes against PyArrow 25.0.1, then covered by focused tests against the patched source.

Raw logs

$ python -c 'import pyarrow.parquet as pq; pq.SortingColumn.from_ordering(None, [])'
Segmentation fault: 11
$ echo $?
139

$ python -c 'import pyarrow as pa; import pyarrow.dataset as ds; ds.FileSystemDataset([None], pa.schema([]), ds.ParquetFileFormat())'
Segmentation fault: 11
$ echo $?
139

$ python -c 'import pyarrow as pa; d=pa.array([], type=pa.string()); pa.DictionaryArray.from_buffers(None, 0, [None, pa.py_buffer(b"")], d)'
Segmentation fault: 11
$ echo $?
139

$ pytest -q python/pyarrow/tests/parquet/test_metadata.py::test_parquet_sorting_column python/pyarrow/tests/test_dataset.py::test_filesystem_dataset python/pyarrow/tests/test_array.py::test_dictionary_from_buffers
....                                                                     [100%]
4 passed

Are there any user-facing changes?

Yes. Invalid None arguments now raise TypeError instead of crashing the interpreter.

• GitHub Issue: [Python] Several APIs segfault when required Arrow object arguments are None #51043

[github-actions]

⚠️ GitHub issue #51043 has been automatically assigned in GitHub to PR creator.

[Copilot]

🟡 Changes recommended

DictionaryArray.from_buffers() still allows dictionary=None while dereferencing it unconditionally, so a None argument can still trigger a crash.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens several PyArrow Cython entry points by rejecting None for required Arrow extension objects, preventing null C++ pointer dereferences that can segfault the Python interpreter (GH-51043).

Changes:

• Mark required Schema, FileFormat, and DataType parameters as non-nullable (not None) at the Cython boundary to raise TypeError instead of crashing.
• Add an explicit None check for FileSystemDataset fragments before unwrapping.
• Add focused regression tests covering the newly rejected None arguments.

File summaries

File	Description
python/pyarrow/_dataset.pyx	Reject None fragments and make schema/format non-nullable in FileSystemDataset.
python/pyarrow/_parquet.pyx	Make SortingColumn conversion helpers reject schema=None at the boundary.
python/pyarrow/array.pxi	Make DictionaryArray.from_buffers reject type=None at the boundary.
python/pyarrow/tests/test_dataset.py	Add regression assertions for FileSystemDataset(..., schema=None/format=None) and [None] fragments.
python/pyarrow/tests/parquet/test_metadata.py	Add regression assertions for SortingColumn.* with schema=None.
python/pyarrow/tests/test_array.py	Add regression assertion for DictionaryArray.from_buffers(type=None, ...).

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.