Fix HashChild reusing a nested field's unshifted validity buffer

HashChild built its returned ArrayData with offset 0, but reused the
child's raw validity buffer as-is. That buffer requires bit index
child.offset + i to read logical row i, while every caller (via
ToColumnArray, which never applies ArrayData::offset itself) reads
buffer bit 0 as row 0. If a struct's nested field is itself an offset
slice of a larger array, this misread validity by child.offset bits,
misclassifying valid rows as null (or vice versa) and producing wrong
combined hashes.

Confirmed with a repro: a struct wrapping a list field sliced to
offset=3 hashed row 0 (valid) as 0, colliding with null, while an
equivalent independently-built struct hashed it correctly.

Fixed by repacking the validity bitmap into a fresh, 0-based buffer in
HashChild, so it's self-consistent with the already-0-based hash values
buffer built alongside it.

Author: kszucs

cpp/src/arrow/compute/kernels/scalar_hash.cc

@@ -26,6 +26,7 @@
 #include "arrow/compute/registry_internal.h"
 #include "arrow/compute/util.h"
 #include "arrow/result.h"
+#include "arrow/util/bitmap_ops.h"
 
 namespace arrow {
 namespace compute {
@@ -136,8 +137,21 @@ struct FastHashScalar {
     ARROW_ASSIGN_OR_RAISE(auto buffer, AllocateBuffer(buffer_size, memory_pool));
     ARROW_RETURN_NOT_OK(
         HashArray(sliced, hash_ctx, memory_pool, buffer->mutable_data_as<c_type>()));
+
+    std::shared_ptr<Buffer> validity;
+    if (sliced.GetBuffer(0) != nullptr) {
+      // sliced.GetBuffer(0) is unshifted: reading logical row i requires bit
+      // `sliced.offset + i`. But the returned ArrayData has offset 0, and callers
+      // build a KeyColumnArray directly from its buffers without applying that
+      // offset themselves (see ToColumnArray, which always treats bit/byte 0 of a
+      // buffer as row 0). Repack into a fresh, 0-based bitmap so it's self-consistent
+      // with the hash values buffer, which is already 0-based.
+      ARROW_ASSIGN_OR_RAISE(validity, ::arrow::internal::CopyBitmap(
+                                          memory_pool, sliced.GetBuffer(0)->data(),
+                                          sliced.offset, sliced.length));
+    }
     return ArrayData::Make(arrow_type, sliced.length,
-                           {sliced.GetBuffer(0), std::move(buffer)}, sliced.null_count);
+                           {std::move(validity), std::move(buffer)}, sliced.null_count);
   }
 
   static Status HashStructArray(const ArraySpan& array, LightContext* hash_ctx,

cpp/src/arrow/compute/kernels/scalar_hash_test.cc

@@ -804,6 +804,51 @@ TEST_F(TestScalarHash, NestedNullFieldWithinValidStructHashesToZero) {
   }
 }
 
+// Guards against HashChild reusing a nested field's raw (unshifted) validity buffer
+// without rebasing it: the buffer requires bit `child.offset + i` to read logical row
+// i, but the returned ArrayData has offset 0 and its buffer is read directly (bit 0 =
+// row 0) once wrapped in a KeyColumnArray. If a struct's nested field is itself an
+// offset slice of a larger array (e.g. GH-17211), this misreads validity by
+// `child.offset` bits -- here, a valid row would be misread as null (or vice versa)
+// unless the buffer is rebased to be self-consistent with the fresh hash values.
+TEST_F(TestScalarHash, NestedFieldWithOwnOffsetHashesCorrectly) {
+  ListBuilder list_builder(default_memory_pool(), std::make_shared<Int32Builder>());
+  auto* values = checked_cast<Int32Builder*>(list_builder.value_builder());
+  ASSERT_OK(list_builder.AppendNull());
+  for (int32_t row = 1; row < 10; row++) {
+    ASSERT_OK(list_builder.Append());
+    ASSERT_OK(values->Append(row));
+    ASSERT_OK(values->Append(row + 1));
+  }
+  ASSERT_OK_AND_ASSIGN(auto base, list_builder.Finish());
+  auto sliced_field = base->Slice(3, 5);  // offset=3, length=5; logical row 0 = valid
+
+  ASSERT_OK_AND_ASSIGN(auto struct_with_offset_field,
+                       StructArray::Make({sliced_field}, {field("f0", list(int32()))}));
+
+  ListBuilder independent_builder(default_memory_pool(),
+                                  std::make_shared<Int32Builder>());
+  auto* independent_values =
+      checked_cast<Int32Builder*>(independent_builder.value_builder());
+  for (int32_t row = 3; row < 8; row++) {
+    ASSERT_OK(independent_builder.Append());
+    ASSERT_OK(independent_values->Append(row));
+    ASSERT_OK(independent_values->Append(row + 1));
+  }
+  ASSERT_OK_AND_ASSIGN(auto independent_field, independent_builder.Finish());
+  ASSERT_OK_AND_ASSIGN(
+      auto independent_struct,
+      StructArray::Make({independent_field}, {field("f0", list(int32()))}));
+
+  for (const std::string func : {"hash32", "hash64"}) {
+    ASSERT_OK_AND_ASSIGN(Datum offset_result,
+                         CallFunction(func, {struct_with_offset_field}));
+    ASSERT_OK_AND_ASSIGN(Datum independent_result,
+                         CallFunction(func, {independent_struct}));
+    AssertDatumsEqual(offset_result, independent_result);
+  }
+}
+
 // The EXTENSION unwrapping at the top of HashArray should compose with the
 // is_list_like recursion; this combination was otherwise untested (ExtensionType
 // above only wraps a primitive).