[ntuple] RNTupleModel columns ownership issue

[mxxo]

• [x] Checked for duplicates

Describe the bug

The following code causes a crash:

// sink is destroyed before model
auto model = RNTupleModel::Create();
auto fieldPt = model->MakeField<float>("pt", 42.0);
{
   RPageSinkFile sink("myNTuple", "file.root", RNTupleWriteOptions());
   sink.Create(*model.get());
   // uncomment to run successfully
   // model = nullptr; 
} 

pure virtual method called
terminate called without an active exception
Aborted (core dumped)

The following sequence is seemingly to blame (worked out with @jblomer):

1. The model owns fields
2. On sink.Create(), these fields get their columns connected to the page sink
3. The columns get their pages allocated from the page sink
4. On destruction, the columns ask the page sink to help the free the pages
5. So the columns (i.e. fields, i.e. model) must not be deconstructed after the page sink they are connected to

Note: the user-level RNTupleWriter API is immune to this issue because of class member destruction order: https://github.com/root-project/root/blob/f7df9d527f121ca5f00690dc49f4911dd356cb1c/tree/ntuple/v7/inc/ROOT/RNTuple.hxx#L356-L358

Setup

ROOT master

Additional context

This bug is surprising, but low-severity because users will likely use the higher-level RNTupleReader and Writer APIs. The workaround is straightforward when the root cause is known.

[dpiparo]

I cannot reproduce, even the Create interface changed. @jblomer can this issue be closed?

[jblomer]

This is addressed with the new interfaces