sw: fix undefined casts of SwTxtInputFld

... as reported by sberg via UBSan in CppunitTest_sw_mailmerge:

> sw/source/core/txtnode/thints.cxx:3207:38: runtime error: downcast of address 0x000003cadcb0 which does not point to an object of type 'SwTxtAttrNesting'
> 0x000003cadcb0: note: object is of type 'SwTxtInputFld'
> #0 in SwpHints::TryInsertHint(SwTxtAttr*, SwTxtNode&, unsigned short) sw/source/core/txtnode/thints.cxx:3207:13
> #1 in SwTxtNode::InsertHint(SwTxtAttr*, unsigned short) sw/source/core/txtnode/thints.cxx:1583:25
> #2 in SwTxtNode::SetAttr(SfxItemSet const&, int, int, unsigned short) sw/source/core/txtnode/thints.cxx:1943:39
> #3 in SwRegHistory::InsertItems(SfxItemSet const&, int, int, unsigned short) sw/source/core/undo/rolbck.cxx:1390:28
> #4 in (anonymous namespace)::lcl_InsAttr(SwDoc*, SwPaM const&, SfxItemSet const&, unsigned short, SwUndoAttr*, bool) sw/source/core/doc/DocumentContentOperationsManager.cxx:1169:28
> #5 in sw::DocumentContentOperationsManager::InsertPoolItem(SwPaM const&, SfxPoolItem const&, unsigned short, bool) sw/source/core/doc/DocumentContentOperationsManager.cxx:3041:23
> #6 in SwXTextField::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) sw/source/core/unocore/unofield.cxx:1966:13 > #7 in non-virtual thunk to SwXTextField::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) sw/source/core/unocore/unofield.cxx:2061:1

The SwTxtInputFld is unusual because it's both a field and has a range;
let's try to use virtual inheritance to inherit both from
SwTxtFld and SwTxtAttrNesting.  Sadly requires dynamic_cast everywhere.

Change-Id: I69f834d2b78ef7cdaac1f554bd80711084efcd02

23 files changed, 155 insertions, 114 deletions

diff --git a/sw/inc/txatbase.hxx b/sw/inc/txatbase.hxx
index 222857da0d0d..830d097128c4 100644
--- a/sw/inc/txatbase.hxx
+++ b/sw/inc/txatbase.hxx
@@ -121,7 +121,7 @@ public:
 
 };
 
-class SwTxtAttrEnd : public SwTxtAttr
+class SwTxtAttrEnd : public virtual SwTxtAttr
 {
 protected:
     sal_Int32 m_nEnd;
@@ -132,6 +132,15 @@ public:
     virtual sal_Int32* GetEnd() SAL_OVERRIDE;
 };
 
+// attribute that must not overlap others
+class SwTxtAttrNesting : public SwTxtAttrEnd
+{
+protected:
+    SwTxtAttrNesting( SfxPoolItem & i_rAttr,
+        const sal_Int32 i_nStart, const sal_Int32 i_nEnd );
+    virtual ~SwTxtAttrNesting();
+};
+
 inline const sal_Int32* SwTxtAttr::End() const
 {
     return const_cast<SwTxtAttr * >(this)->GetEnd();
@@ -227,6 +236,16 @@ inline const SwFmtMeta& SwTxtAttr::GetMeta() const
     return (const SwFmtMeta&)(*m_pAttr);
 }
 
+// these should be static_casts but with virtual inheritance it's not possible
+template<typename T, typename S> inline T static_txtattr_cast(S * s)
+{
+    return dynamic_cast<T>(s);
+}
+template<typename T, typename S> inline T static_txtattr_cast(S & s)
+{
+    return dynamic_cast<T>(s);
+}
+
 #endif
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/inc/txtatr.hxx b/sw/inc/txtatr.hxx
index b8720b09ec6f..a5a4e1d8b282 100644
--- a/sw/inc/txtatr.hxx
+++ b/sw/inc/txtatr.hxx
@@ -50,14 +50,6 @@ public:
 };
 
 
-class SwTxtAttrNesting : public SwTxtAttrEnd
-{
-protected:
-    SwTxtAttrNesting( SfxPoolItem & i_rAttr,
-        const sal_Int32 i_nStart, const sal_Int32 i_nEnd );
-    virtual ~SwTxtAttrNesting();
-};
-
 class SwTxtMeta : public SwTxtAttrNesting
 {
 private:
diff --git a/sw/inc/txtfld.hxx b/sw/inc/txtfld.hxx
index 9758bd28ce3c..946a4bbfa916 100644
--- a/sw/inc/txtfld.hxx
+++ b/sw/inc/txtfld.hxx
@@ -27,7 +27,7 @@
 class SwPaM;
 class SwTxtNode;
 
-class SwTxtFld : public SwTxtAttr
+class SwTxtFld : public virtual SwTxtAttr
 {
     mutable OUString m_aExpand; // only used to determine, if field content is changing in <ExpandTxtFld()>
     SwTxtNode * m_pTxtNode;
@@ -73,7 +73,9 @@ public:
 
 };
 
-class SwTxtInputFld : public SwTxtFld
+class SwTxtInputFld
+    : public SwTxtAttrNesting
+    , public SwTxtFld
 {
 public:
     SwTxtInputFld(
@@ -84,8 +86,6 @@ public:
 
     virtual ~SwTxtInputFld();
 
-    virtual sal_Int32* GetEnd() SAL_OVERRIDE;
-
     void LockNotifyContentChange();
     void UnlockNotifyContentChange();
     virtual void NotifyContentChange( SwFmtFld& rFmtFld ) SAL_OVERRIDE;
@@ -96,7 +96,6 @@ public:
     void UpdateFieldContent();
 
 private:
-    sal_Int32 m_nEnd;
 
     bool m_bLockNotifyContentChange;
 };
diff --git a/sw/source/core/access/accpara.cxx b/sw/source/core/access/accpara.cxx
index b4fe38f066bb..7e0068837560 100644
--- a/sw/source/core/access/accpara.cxx
+++ b/sw/source/core/access/accpara.cxx
@@ -1462,7 +1462,8 @@ OUString SwAccessibleParagraph::GetFieldTypeNameAtIndex(sal_Int32 nIndex)
                        || pHt->Which() == RES_TXTATR_INPUTFIELD )
                      && (nFldIndex-- == 0))
                 {
-                    pTxtFld = (SwTxtFld *)pHt;
+                    pTxtFld = const_cast<SwTxtFld*>(
+                                static_txtattr_cast<SwTxtFld const*>(pHt));
                     break;
                 }
                 else if (pHt->Which() == RES_TXTATR_REFMARK
diff --git a/sw/source/core/crsr/crstrvl.cxx b/sw/source/core/crsr/crstrvl.cxx
index c956ecee5869..dff0b0fdd3fb 100644
--- a/sw/source/core/crsr/crstrvl.cxx
+++ b/sw/source/core/crsr/crstrvl.cxx
@@ -1671,7 +1671,7 @@ bool SwContentAtPos::IsInProtectSect() const
         {
         case SW_FIELD:
         case SW_CLICKFIELD:
-            pNd = ((SwTxtFld*)pFndTxtAttr)->GetpTxtNode();
+            pNd = static_txtattr_cast<SwTxtFld const*>(pFndTxtAttr)->GetpTxtNode();
             break;
 
         case SW_FTN:
@@ -1679,7 +1679,7 @@ bool SwContentAtPos::IsInProtectSect() const
             break;
 
         case SW_INETATTR:
-            pNd = ((SwTxtINetFmt*)pFndTxtAttr)->GetpTxtNode();
+            pNd = static_txtattr_cast<SwTxtINetFmt const*>(pFndTxtAttr)->GetpTxtNode();
             break;
 
         default:
diff --git a/sw/source/core/crsr/findtxt.cxx b/sw/source/core/crsr/findtxt.cxx
index 277b7297d164..c6b2a7478266 100644
--- a/sw/source/core/crsr/findtxt.cxx
+++ b/sw/source/core/crsr/findtxt.cxx
@@ -135,7 +135,7 @@ lcl_CleanStr(const SwTxtNode& rNd, sal_Int32 const nStart, sal_Int32& rEnd,
                         const bool bEmpty =
                             ( pHt->Which() != RES_TXTATR_FIELD
                               && pHt->Which() != RES_TXTATR_ANNOTATION )
-                            || (static_cast<SwTxtFld const*>(pHt)->GetFmtFld().GetField()->ExpandField(true).isEmpty());;
+                            || (static_txtattr_cast<SwTxtFld const*>(pHt)->GetFmtFld().GetField()->ExpandField(true).isEmpty());;
                         if ( bEmpty && nStart == nAkt )
                         {
                             rArr.push_back( nAkt );
@@ -352,7 +352,8 @@ bool SwPaM::Find( const SearchOptions& rSearchOpt, bool bSearchInNotes , utl::Te
                         if ( (bSrchForward && (GetPostIt(aLoop + aIgnore,pHts) < pHts->Count()) ) || ( !bSrchForward && (aLoop!=0) ))
                         {
                             const SwTxtAttr* pTxtAttr = bSrchForward ?  (*pHts)[GetPostIt(aLoop+aIgnore,pHts)] : (*pHts)[GetPostIt(aLoop+aIgnore-1,pHts)];
-                            if ( pPostItMgr && pPostItMgr->SearchReplace(((SwTxtFld*)pTxtAttr)->GetFmtFld(),rSearchOpt,bSrchForward) )
+                            if (pPostItMgr && pPostItMgr->SearchReplace(
+                                    static_txtattr_cast<SwTxtFld const*>(pTxtAttr)->GetFmtFld(),rSearchOpt,bSrchForward))
                             {
                                 bFound = true ;
                                 break;
diff --git a/sw/source/core/docnode/nodes.cxx b/sw/source/core/docnode/nodes.cxx
index 4873847f72f4..4102a7022346 100644
--- a/sw/source/core/docnode/nodes.cxx
+++ b/sw/source/core/docnode/nodes.cxx
@@ -270,7 +270,7 @@ void SwNodes::ChgNode( SwNodeIndex& rDelPos, sal_uLong nSz,
                             case RES_TXTATR_ANNOTATION:
                             case RES_TXTATR_INPUTFIELD:
                                 {
-                                    SwTxtFld* pTxtFld = static_cast<SwTxtFld*>(pAttr);
+                                    SwTxtFld* pTxtFld = static_txtattr_cast<SwTxtFld*>(pAttr);
                                     rNds.GetDoc()->getIDocumentFieldsAccess().InsDelFldInFldLst( !bToUndo, *pTxtFld );
 
                                     const SwFieldType* pTyp = pTxtFld->GetFmtFld().GetField()->GetTyp();
@@ -314,7 +314,7 @@ void SwNodes::ChgNode( SwNodeIndex& rDelPos, sal_uLong nSz,
                             case RES_TXTATR_METAFIELD:
                                 {
                                     SwTxtMeta *const pTxtMeta(
-                                        static_cast<SwTxtMeta*>(pAttr));
+                                        static_txtattr_cast<SwTxtMeta*>(pAttr));
                                     // force removal of UNO object
                                     pTxtMeta->ChgTxtNode(0);
                                     pTxtMeta->ChgTxtNode(pTxtNd);
diff --git a/sw/source/core/fields/cellfml.cxx b/sw/source/core/fields/cellfml.cxx
index a9a01d8362af..fc7bed25b660 100644
--- a/sw/source/core/fields/cellfml.cxx
+++ b/sw/source/core/fields/cellfml.cxx
@@ -153,7 +153,7 @@ double SwTableBox::GetValue( SwTblCalcPara& rCalcPara ) const
         if ( bOK && (Char==CH_TXTATR_BREAKWORD || Char==CH_TXTATR_INWORD) )
         {
             SwTxtFld * const pTxtFld =
-                static_cast<SwTxtFld*>( pTxtNd->GetTxtAttrForCharAt( nSttPos, RES_TXTATR_FIELD ) );
+                static_txtattr_cast<SwTxtFld*>(pTxtNd->GetTxtAttrForCharAt(nSttPos, RES_TXTATR_FIELD));
             if ( pTxtFld == NULL )
                 break;
 
diff --git a/sw/source/core/text/atrstck.cxx b/sw/source/core/text/atrstck.cxx
index 365cca4493a4..eb4584fb7c5d 100644
--- a/sw/source/core/text/atrstck.cxx
+++ b/sw/source/core/text/atrstck.cxx
@@ -210,23 +210,23 @@ static bool lcl_ChgHyperLinkColor( const SwTxtAttr& rAttr,
     // We do not want to show visited links:
     // (printing, pdf export, page preview)
 
+    SwTxtINetFmt & rINetAttr(const_cast<SwTxtINetFmt&>(
+                            static_txtattr_cast<SwTxtINetFmt const&>(rAttr)));
     if ( pShell->GetOut()->GetOutDevType() == OUTDEV_PRINTER ||
          pShell->GetViewOptions()->IsPDFExport() ||
          pShell->GetViewOptions()->IsPagePreview() )
     {
-        if ( ((SwTxtINetFmt&)rAttr).IsVisited() )
+        if (rINetAttr.IsVisited())
         {
             if ( pColor )
             {
                 // take color from character format 'unvisited link'
-                SwTxtINetFmt& rInetAttr( const_cast<SwTxtINetFmt&>(
-                    static_cast<const SwTxtINetFmt&>(rAttr)) );
-                rInetAttr.SetVisited( false );
-                const SwCharFmt* pTmpFmt = ((SwTxtINetFmt&)rAttr).GetCharFmt();
+                rINetAttr.SetVisited(false);
+                const SwCharFmt* pTmpFmt = rINetAttr.GetCharFmt();
                 const SfxPoolItem* pItem;
                 pTmpFmt->GetItemState( RES_CHRATR_COLOR, true, &pItem );
                 *pColor = ((SvxColorItem*)pItem)->GetValue();
-                rInetAttr.SetVisited( true );
+                rINetAttr.SetVisited(true);
             }
             return true;
         }
@@ -240,14 +240,14 @@ static bool lcl_ChgHyperLinkColor( const SwTxtAttr& rAttr,
 
     if ( pShell->GetWin() &&
         (
-          (((SwTxtINetFmt&)rAttr).IsVisited() && SwViewOption::IsVisitedLinks()) ||
-          (!((SwTxtINetFmt&)rAttr).IsVisited() && SwViewOption::IsLinks())
+          (rINetAttr.IsVisited() && SwViewOption::IsVisitedLinks()) ||
+          (!rINetAttr.IsVisited() && SwViewOption::IsLinks())
         )
        )
     {
         if ( pColor )
         {
-            if ( ((SwTxtINetFmt&)rAttr).IsVisited() )
+            if (rINetAttr.IsVisited())
             {
                 // take color from view option 'visited link color'
                 *pColor = SwViewOption::GetVisitedLinksColor();
diff --git a/sw/source/core/text/pormulti.cxx b/sw/source/core/text/pormulti.cxx
index eb569db84723..736bbb874864 100644
--- a/sw/source/core/text/pormulti.cxx
+++ b/sw/source/core/text/pormulti.cxx
@@ -563,7 +563,8 @@ SwRubyPortion::SwRubyPortion( const SwMultiCreator& rCreate, const SwFont& rFnt,
     else
         SetTop( ! rRuby.GetPosition() );
 
-    const SwCharFmt* pFmt = ((SwTxtRuby*)rCreate.pAttr)->GetCharFmt();
+    const SwCharFmt *const pFmt =
+        static_txtattr_cast<SwTxtRuby const*>(rCreate.pAttr)->GetCharFmt();
     SwFont *pRubyFont;
     if( pFmt )
     {
diff --git a/sw/source/core/text/txtfld.cxx b/sw/source/core/text/txtfld.cxx
index 8b925cf31ac1..465c74c43b30 100644
--- a/sw/source/core/text/txtfld.cxx
+++ b/sw/source/core/text/txtfld.cxx
@@ -123,7 +123,7 @@ SwExpandPortion *SwTxtFormatter::NewFldPortion( SwTxtFormatInfo &rInf,
             if( !bName && pSh && !pSh->Imp()->IsUpdateExpFlds() )
             {
                 ((SwChapterField*)pFld)->ChangeExpansion( pFrame,
-                                        &((SwTxtFld*)pHint)->GetTxtNode() );
+                    &static_txtattr_cast<SwTxtFld const*>(pHint)->GetTxtNode());
             }
             {
                 OUString const aStr( (bName)
@@ -185,12 +185,14 @@ SwExpandPortion *SwTxtFormatter::NewFldPortion( SwTxtFormatInfo &rInf,
                 if( !::lcl_IsInBody( pFrame ) )
                 {
                     pExpFld->ChgBodyTxtFlag( false );
-                    pExpFld->ChangeExpansion( *pFrame, *((SwTxtFld*)pHint) );
+                    pExpFld->ChangeExpansion(*pFrame,
+                            *static_txtattr_cast<SwTxtFld const*>(pHint));
                 }
                 else if( !pExpFld->IsInBodyTxt() )
                 {
                     // war vorher anders, also erst expandieren, dann umsetzen!!
-                    pExpFld->ChangeExpansion( *pFrame, *((SwTxtFld*)pHint) );
+                    pExpFld->ChangeExpansion(*pFrame,
+                            *static_txtattr_cast<SwTxtFld const*>(pHint));
                     pExpFld->ChgBodyTxtFlag( true );
                 }
             }
@@ -220,7 +222,8 @@ SwExpandPortion *SwTxtFormatter::NewFldPortion( SwTxtFormatInfo &rInf,
         case RES_REFPAGEGETFLD:
             if( !bName && pSh && !pSh->Imp()->IsUpdateExpFlds() )
             {
-                ((SwRefPageGetField*)pFld)->ChangeExpansion( pFrame, (SwTxtFld*)pHint );
+                ((SwRefPageGetField*)pFld)->ChangeExpansion(pFrame,
+                        static_txtattr_cast<SwTxtFld const*>(pHint));
             }
             {
                 OUString const aStr( (bName)
diff --git a/sw/source/core/txtnode/atrfld.cxx b/sw/source/core/txtnode/atrfld.cxx
index 828bc64b4a0f..6455a193aec9 100644
--- a/sw/source/core/txtnode/atrfld.cxx
+++ b/sw/source/core/txtnode/atrfld.cxx
@@ -329,6 +329,8 @@ bool SwFmtFld::IsProtect() const
            && mpTxtFld->GetpTxtNode()->IsProtect();
 }
 
+// class SwTxtFld ////////////////////////////////////////////////////
+
 SwTxtFld::SwTxtFld(
     SwFmtFld & rAttr,
     sal_Int32 const nStartPos,
@@ -501,6 +503,8 @@ void SwTxtFld::DeleteTxtFld( const SwTxtFld& rTxtFld )
     }
 }
 
+// class SwTxtInputFld ///////////////////////////////////////////////
+
 // input field in-place editing
 SwTxtInputFld::SwTxtInputFld(
     SwFmtFld & rAttr,
@@ -508,29 +512,19 @@ SwTxtInputFld::SwTxtInputFld(
     sal_Int32 const nEnd,
     bool const bInClipboard )
 
-    : SwTxtFld( rAttr, nStart, bInClipboard )
-    , m_nEnd( nEnd )
+    : SwTxtAttr( rAttr, nStart )
+    , SwTxtAttrNesting( rAttr, nStart, nEnd )
+    , SwTxtFld( rAttr, nStart, bInClipboard )
     , m_bLockNotifyContentChange( false )
 {
     SetHasDummyChar( false );
     SetHasContent( true );
-
-    SetDontExpand( true );
-    SetLockExpandFlag( true );
-    SetDontExpandStartAttr( true );
-
-    SetNesting( true );
 }
 
 SwTxtInputFld::~SwTxtInputFld()
 {
 }
 
-sal_Int32* SwTxtInputFld::GetEnd()
-{
-    return &m_nEnd;
-}
-
 void SwTxtInputFld::LockNotifyContentChange()
 {
     m_bLockNotifyContentChange = true;
@@ -602,12 +596,15 @@ void SwTxtInputFld::UpdateTextNodeContent( const OUString& rNewContent )
     GetTxtNode().ReplaceText( aIdx, nDelLen, rNewContent );
 }
 
+// class SwTxtAnnotationFld //////////////////////////////////////////
+
 // text annotation field
 SwTxtAnnotationFld::SwTxtAnnotationFld(
     SwFmtFld & rAttr,
     sal_Int32 const nStart,
     bool const bInClipboard )
-    : SwTxtFld( rAttr, nStart, bInClipboard )
+    : SwTxtAttr( rAttr, nStart )
+    , SwTxtFld( rAttr, nStart, bInClipboard )
 {
 }
 
diff --git a/sw/source/core/txtnode/atrref.cxx b/sw/source/core/txtnode/atrref.cxx
index 35f338b30e48..48c87a474656 100644
--- a/sw/source/core/txtnode/atrref.cxx
+++ b/sw/source/core/txtnode/atrref.cxx
@@ -75,7 +75,8 @@ void SwFmtRefMark::InvalidateRefMark()
 
 SwTxtRefMark::SwTxtRefMark( SwFmtRefMark& rAttr,
             sal_Int32 const nStartPos, sal_Int32 const*const pEnd)
-    : SwTxtAttrEnd( rAttr, nStartPos, nStartPos )
+    : SwTxtAttr(rAttr, nStartPos)
+    , SwTxtAttrEnd( rAttr, nStartPos, nStartPos )
     , m_pTxtNode( 0 )
     , m_pEnd( 0 )
 {
diff --git a/sw/source/core/txtnode/atrtox.cxx b/sw/source/core/txtnode/atrtox.cxx
index 81077385112f..1cbd87a94ac1 100644
--- a/sw/source/core/txtnode/atrtox.cxx
+++ b/sw/source/core/txtnode/atrtox.cxx
@@ -25,7 +25,8 @@
 
 SwTxtTOXMark::SwTxtTOXMark( SwTOXMark& rAttr,
             sal_Int32 const nStartPos, sal_Int32 const*const pEnd)
-    : SwTxtAttrEnd( rAttr, nStartPos, nStartPos )
+    : SwTxtAttr( rAttr, nStartPos )
+    , SwTxtAttrEnd( rAttr, nStartPos, nStartPos )
     , m_pTxtNode( 0 )
     , m_pEnd( 0 )
 {
diff --git a/sw/source/core/txtnode/modeltoviewhelper.cxx b/sw/source/core/txtnode/modeltoviewhelper.cxx
index 68a7cbb8b76e..ad268cdfccde 100644
--- a/sw/source/core/txtnode/modeltoviewhelper.cxx
+++ b/sw/source/core/txtnode/modeltoviewhelper.cxx
@@ -149,7 +149,7 @@ ModelToViewHelper::ModelToViewHelper(const SwTxtNode &rNode, sal_uInt16 eMode)
                             {
                                 aFieldResult.m_sExpand = (eMode & REPLACEMODE)
                                     ? OUString(CHAR_ZWSP)
-                                    : static_cast<SwTxtFld const*>(pAttr)->
+                                    : static_txtattr_cast<SwTxtFld const*>(pAttr)->
                                       GetFmtFld().GetField()->ExpandField(true);
                                 aFieldResult.m_eType = FieldResult::FIELD;
                             }
diff --git a/sw/source/core/txtnode/ndhints.cxx b/sw/source/core/txtnode/ndhints.cxx
index ea5f4d8a7ba4..200f2114b1be 100644
--- a/sw/source/core/txtnode/ndhints.cxx
+++ b/sw/source/core/txtnode/ndhints.cxx
@@ -44,8 +44,10 @@ static bool lcl_IsLessStart( const SwTxtAttr &rHt1, const SwTxtAttr &rHt2 )
             {
                 if ( RES_TXTATR_CHARFMT == nWhich1 )
                 {
-                    const sal_uInt16 nS1 = static_cast<const SwTxtCharFmt&>(rHt1).GetSortNumber();
-                    const sal_uInt16 nS2 = static_cast<const SwTxtCharFmt&>(rHt2).GetSortNumber();
+                    const sal_uInt16 nS1 =
+                        static_txtattr_cast<const SwTxtCharFmt&>(rHt1).GetSortNumber();
+                    const sal_uInt16 nS2 =
+                        static_txtattr_cast<const SwTxtCharFmt&>(rHt2).GetSortNumber();
                     if ( nS1 != nS2 ) // robust
                         return nS1 < nS2;
                 }
@@ -75,8 +77,10 @@ static bool lcl_IsLessEnd( const SwTxtAttr &rHt1, const SwTxtAttr &rHt2 )
             {
                 if ( RES_TXTATR_CHARFMT == nWhich1 )
                 {
-                    const sal_uInt16 nS1 = static_cast<const SwTxtCharFmt&>(rHt1).GetSortNumber();
-                    const sal_uInt16 nS2 = static_cast<const SwTxtCharFmt&>(rHt2).GetSortNumber();
+                    const sal_uInt16 nS1 =
+                        static_txtattr_cast<const SwTxtCharFmt&>(rHt1).GetSortNumber();
+                    const sal_uInt16 nS2 =
+                        static_txtattr_cast<const SwTxtCharFmt&>(rHt2).GetSortNumber();
                     if ( nS1 != nS2 ) // robust
                         return nS1 > nS2;
                 }
@@ -257,9 +261,9 @@ bool SwpHintsArray::Check(bool bPortionsMerged) const
                     ) // never two AUTOFMT on same range
                 &&  (   (pHtThis->Which() != RES_TXTATR_CHARFMT)
                     ||  (pHtLast->Which() != RES_TXTATR_CHARFMT)
-                    ||  (static_cast<const SwTxtCharFmt *>(pHtThis)
+                    ||  (static_txtattr_cast<const SwTxtCharFmt *>(pHtThis)
                                 ->GetSortNumber() !=
-                         static_cast<const SwTxtCharFmt *>(pHtLast)
+                         static_txtattr_cast<const SwTxtCharFmt *>(pHtLast)
                                 ->GetSortNumber())
                     ) // multiple CHARFMT on same range need distinct sortnr
                 )
diff --git a/sw/source/core/txtnode/ndtxt.cxx b/sw/source/core/txtnode/ndtxt.cxx
index 5f9f95ccf233..59793051e238 100644
--- a/sw/source/core/txtnode/ndtxt.cxx
+++ b/sw/source/core/txtnode/ndtxt.cxx
@@ -1406,7 +1406,8 @@ void lcl_CopyHint(
         {
             if( pOtherDoc != NULL )
             {
-                static_cast<const SwTxtFld*>(pHt)->CopyTxtFld( static_cast<SwTxtFld*>(pNewHt) );
+                static_txtattr_cast<const SwTxtFld*>(pHt)->CopyTxtFld(
+                        static_txtattr_cast<SwTxtFld*>(pNewHt));
             }
 
             // Tabellenformel ??
@@ -1416,7 +1417,7 @@ void lcl_CopyHint(
             {
                 // wandel die interne in eine externe Formel um
                 const SwTableNode* const pDstTblNd =
-                    static_cast<const SwTxtFld*>(pHt)->GetTxtNode().FindTableNode();
+                    static_txtattr_cast<const SwTxtFld*>(pHt)->GetTxtNode().FindTableNode();
                 if( pDstTblNd )
                 {
                     SwTblField* const pTblFld =
@@ -1432,7 +1433,8 @@ void lcl_CopyHint(
     case RES_TXTATR_ANNOTATION :
         if( pOtherDoc != NULL )
         {
-            static_cast<const SwTxtFld*>(pHt)->CopyTxtFld( static_cast<SwTxtFld*>(pNewHt) );
+            static_txtattr_cast<const SwTxtFld*>(pHt)->CopyTxtFld(
+                    static_txtattr_cast<SwTxtFld*>(pNewHt));
         }
         break;
 
@@ -1442,7 +1444,7 @@ void lcl_CopyHint(
         {
             // Beim Kopieren von TOXMarks(Client) in andere Dokumente
             // muss der Verzeichnis (Modify) ausgetauscht werden
-            static_cast<SwTxtTOXMark*>(pNewHt)->CopyTOXMark( pOtherDoc );
+            static_txtattr_cast<SwTxtTOXMark*>(pNewHt)->CopyTOXMark(pOtherDoc);
         }
         break;
 
@@ -1470,8 +1472,8 @@ void lcl_CopyHint(
             if( pOtherDoc && pDest && pDest->GetpSwpHints()
                 && pDest->GetpSwpHints()->Contains( pNewHt ) )
             {
-                const SwDoc* const pDoc = static_cast<const SwTxtINetFmt*>(pHt)
-                    ->GetTxtNode().GetDoc();
+                const SwDoc* const pDoc = static_txtattr_cast<
+                        const SwTxtINetFmt*>(pHt)->GetTxtNode().GetDoc();
                 if ( pDoc )
                 {
                     const SwCharFmts* pCharFmts = pDoc->GetCharFmts();
@@ -1488,7 +1490,7 @@ void lcl_CopyHint(
             //JP 24.04.98: Bug 49753 - ein TextNode muss am Attribut
             //              gesetzt sein, damit die Vorlagen erzeugt
             //              werden koenne
-            SwTxtINetFmt* const pINetHt = static_cast<SwTxtINetFmt*>(pNewHt);
+            SwTxtINetFmt *const pINetHt = static_txtattr_cast<SwTxtINetFmt*>(pNewHt);
             if ( !pINetHt->GetpTxtNode() )
             {
                 pINetHt->ChgTxtNode( pDest );
@@ -3030,7 +3032,7 @@ static void Replace0xFF(
                         if( bExpandFlds )
                         {
                             const OUString aExpand(
-                                static_cast<SwTxtFld const*>(pAttr)->GetFmtFld().GetField()->ExpandField(true));
+                                static_txtattr_cast<SwTxtFld const*>(pAttr)->GetFmtFld().GetField()->ExpandField(true));
                             rTxt.insert(nPos, aExpand);
                             nPos = nPos + aExpand.getLength();
                             nEndPos = nEndPos + aExpand.getLength();
@@ -3196,7 +3198,7 @@ bool SwTxtNode::GetExpandTxt( SwTxtNode& rDestNd, const SwIndex* pDestIdx,
                 case RES_TXTATR_ANNOTATION:
                     {
                         OUString const aExpand(
-                            static_cast<SwTxtFld const*>(pHt)->GetFmtFld().GetField()->ExpandField(true) );
+                            static_txtattr_cast<SwTxtFld const*>(pHt)->GetFmtFld().GetField()->ExpandField(true));
                         if (!aExpand.isEmpty())
                         {
                             ++aDestIdx;     // dahinter einfuegen;
diff --git a/sw/source/core/txtnode/thints.cxx b/sw/source/core/txtnode/thints.cxx
index 5e49b5a0df80..a38fae5de72f 100644
--- a/sw/source/core/txtnode/thints.cxx
+++ b/sw/source/core/txtnode/thints.cxx
@@ -105,7 +105,7 @@ struct TxtAttrDeleter
         if (RES_TXTATR_META == pAttr->Which() ||
             RES_TXTATR_METAFIELD == pAttr->Which())
         {
-            static_cast<SwTxtMeta *>(pAttr)->ChgTxtNode(0); // prevents ASSERT
+            static_txtattr_cast<SwTxtMeta *>(pAttr)->ChgTxtNode(0); // prevents ASSERT
         }
         SwTxtAttr::Destroy( pAttr, m_rPool );
     }
@@ -237,19 +237,19 @@ MakeTxtAttrNesting(SwTxtNode & rNode, SwTxtAttrNesting & rNesting,
     {
         case RES_TXTATR_INETFMT:
         {
-            static_cast<SwTxtINetFmt*>(pNew)->InitINetFmt(rNode);
+            static_txtattr_cast<SwTxtINetFmt*>(pNew)->InitINetFmt(rNode);
             break;
         }
         case RES_TXTATR_CJK_RUBY:
         {
-            static_cast<SwTxtRuby*>(pNew)->InitRuby(rNode);
+            static_txtattr_cast<SwTxtRuby*>(pNew)->InitRuby(rNode);
             break;
         }
         default:
             OSL_FAIL("MakeTxtAttrNesting: what the hell is that?");
             break;
     }
-    return static_cast<SwTxtAttrNesting*>(pNew);
+    return static_txtattr_cast<SwTxtAttrNesting*>(pNew);
 }
 
 typedef ::std::vector<SwTxtAttrNesting *> NestList_t;
@@ -400,7 +400,7 @@ SwpHints::TryInsertNesting( SwTxtNode & rNode, SwTxtAttrNesting & rNewHint )
                         break;
                     case SPLIT_OTHER:
                         OverlappingExisting.push_back(
-                            static_cast<SwTxtAttrNesting*>(pOther));
+                            static_txtattr_cast<SwTxtAttrNesting*>(pOther));
                         break;
                     default:
                         OSL_FAIL("bad code monkey");
@@ -413,7 +413,7 @@ SwpHints::TryInsertNesting( SwTxtNode & rNode, SwTxtAttrNesting & rNewHint )
                 {
                 // ruby and hyperlink: if there is nesting, _overwrite_
                 OverwrittenExisting.push_back(
-                    static_cast<SwTxtAttrNesting*>(pOther));
+                    static_txtattr_cast<SwTxtAttrNesting*>(pOther));
                 }
                 else if ((nNewStart == nOtherStart) && pOther->HasDummyChar())
                 {
@@ -620,7 +620,10 @@ void SwpHints::BuildPortions( SwTxtNode& rNode, SwTxtAttr& rNewHint,
                 SwTxtAttr* pNewAttr = MakeTxtAttr( *rNode.GetDoc(),
                         pOther->GetAttr(), nOtherStart, nThisStart );
                 if ( RES_TXTATR_CHARFMT == pOther->Which() )
-                    static_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber( static_cast<SwTxtCharFmt*>(pOther)->GetSortNumber() );
+                {
+                    static_txtattr_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber(
+                        static_txtattr_cast<SwTxtCharFmt*>(pOther)->GetSortNumber() );
+                }
                 aInsDelHints.push_back( pNewAttr );
 
                 NoteInHistory( pOther );
@@ -637,7 +640,10 @@ void SwpHints::BuildPortions( SwTxtNode& rNode, SwTxtAttr& rNewHint,
                 SwTxtAttr* pNewAttr = MakeTxtAttr( *rNode.GetDoc(),
                         pOther->GetAttr(), nOtherStart, nThisEnd );
                 if ( RES_TXTATR_CHARFMT == pOther->Which() )
-                    static_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber( static_cast<SwTxtCharFmt*>(pOther)->GetSortNumber() );
+                {
+                    static_txtattr_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber(
+                        static_txtattr_cast<SwTxtCharFmt*>(pOther)->GetSortNumber());
+                }
                 aInsDelHints.push_back( pNewAttr );
 
                 NoteInHistory( pOther );
@@ -806,7 +812,7 @@ void SwpHints::BuildPortions( SwTxtNode& rNode, SwTxtAttr& rNewHint,
             {
                 pNewAttr = MakeTxtAttr( *rNode.GetDoc(), rNewHint.GetAttr(),
                         nPorStart, nPorEnd );
-                static_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber( nCharStyleCount );
+                static_txtattr_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber(nCharStyleCount);
             }
         }
         else
@@ -1140,13 +1146,14 @@ void SwTxtNode::DestroyAttr( SwTxtAttr* pAttr )
         case RES_TXTATR_INPUTFIELD:
             if( !pDoc->IsInDtor() )
             {
+                SwTxtFld *const pTxtFld(static_txtattr_cast<SwTxtFld*>(pAttr));
                 // Wenn wir ein HiddenParaField sind, dann muessen wir
                 // ggf. fuer eine Neuberechnung des Visible-Flags sorgen.
                 const SwField* pFld = pAttr->GetFmtFld().GetField();
 
                 //JP 06-08-95: DDE-Felder bilden eine Ausnahme
                 OSL_ENSURE( RES_DDEFLD == pFld->GetTyp()->Which() ||
-                        this == ((SwTxtFld*)pAttr)->GetpTxtNode(),
+                        this == pTxtFld->GetpTxtNode(),
                         "Wo steht denn dieses Feld?" );
 
                 // bestimmte Felder mussen am Doc das Calculations-Flag updaten
@@ -1163,16 +1170,16 @@ void SwTxtNode::DestroyAttr( SwTxtAttr* pAttr )
                 case RES_DBNUMSETFLD:
                 case RES_DBNEXTSETFLD:
                     if( !pDoc->getIDocumentFieldsAccess().IsNewFldLst() && GetNodes().IsDocNodes() )
-                        pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst( false, *(SwTxtFld*)pAttr );
+                        pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst(false, *pTxtFld);
                     break;
                 case RES_DDEFLD:
-                    if( GetNodes().IsDocNodes() &&
-                        ((SwTxtFld*)pAttr)->GetpTxtNode() )
+                    if (GetNodes().IsDocNodes() && pTxtFld->GetpTxtNode())
                         ((SwDDEFieldType*)pFld->GetTyp())->DecRefCnt();
                     break;
                 case RES_POSTITFLD:
                     {
-                        const_cast<SwFmtFld&>(pAttr->GetFmtFld()).Broadcast( SwFmtFldHint( &((SwTxtFld*)pAttr)->GetFmtFld(), SwFmtFldHintWhich::REMOVED ) );
+                        const_cast<SwFmtFld&>(pAttr->GetFmtFld()).Broadcast(
+                            SwFmtFldHint(&pTxtFld->GetFmtFld(), SwFmtFldHintWhich::REMOVED));
                         break;
                     }
                 }
@@ -1190,7 +1197,7 @@ void SwTxtNode::DestroyAttr( SwTxtAttr* pAttr )
 
         case RES_TXTATR_META:
         case RES_TXTATR_METAFIELD:
-            static_cast<SwTxtMeta*>(pAttr)->ChgTxtNode(0);
+            static_txtattr_cast<SwTxtMeta*>(pAttr)->ChgTxtNode(0);
             break;
 
         default:
@@ -2921,7 +2928,7 @@ static void lcl_CheckSortNumber( const SwpHints& rHints, SwTxtCharFmt& rNewCharF
 
             if ( nOtherStart == nHtStart && nOtherEnd == nHtEnd )
             {
-                nSortNumber = static_cast<const SwTxtCharFmt*>(pOtherHt)->GetSortNumber() + 1;
+                nSortNumber = static_txtattr_cast<const SwTxtCharFmt*>(pOtherHt)->GetSortNumber() + 1;
             }
         }
     }
@@ -2968,7 +2975,7 @@ bool SwpHints::TryInsertHint(
         if ( SfxItemState::SET == pFmt->GetItemState( RES_CHRATR_HIDDEN, true, &pItem ) )
             rNode.SetCalcHiddenCharFlags();
 
-        ((SwTxtCharFmt*)pHint)->ChgTxtNode( &rNode );
+        static_txtattr_cast<SwTxtCharFmt*>(pHint)->ChgTxtNode( &rNode );
         break;
     }
     // #i75430# Recalc hidden flags if necessary
@@ -3003,17 +3010,18 @@ bool SwpHints::TryInsertHint(
         break;
     }
     case RES_TXTATR_INETFMT:
-        static_cast<SwTxtINetFmt*>(pHint)->InitINetFmt(rNode);
+        static_txtattr_cast<SwTxtINetFmt*>(pHint)->InitINetFmt(rNode);
         break;
 
     case RES_TXTATR_FIELD:
     case RES_TXTATR_ANNOTATION:
     case RES_TXTATR_INPUTFIELD:
         {
-            bool bDelFirst = 0 != ((SwTxtFld*)pHint)->GetpTxtNode();
-            ((SwTxtFld*)pHint)->ChgTxtNode( &rNode );
+            SwTxtFld *const pTxtFld(static_txtattr_cast<SwTxtFld*>(pHint));
+            bool bDelFirst = 0 != pTxtFld->GetpTxtNode();
+            pTxtFld->ChgTxtNode( &rNode );
             SwDoc* pDoc = rNode.GetDoc();
-            const SwField* pFld = ((SwTxtFld*)pHint)->GetFmtFld().GetField();
+            const SwField* pFld = pTxtFld->GetFmtFld().GetField();
 
             if( !pDoc->getIDocumentFieldsAccess().IsNewFldLst() )
             {
@@ -3029,9 +3037,9 @@ bool SwpHints::TryInsertHint(
                 case RES_DBNEXTSETFLD:
                     {
                         if( bDelFirst )
-                            pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst( false, *(SwTxtFld*)pHint );
+                            pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst(false, *pTxtFld);
                         if( rNode.GetNodes().IsDocNodes() )
-                            pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst( true, *(SwTxtFld*)pHint );
+                            pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst(true, *pTxtFld);
                     }
                     break;
                 case RES_DDEFLD:
@@ -3057,7 +3065,7 @@ bool SwpHints::TryInsertHint(
                                     pDoc->getIDocumentFieldsAccess().InsertFldType( *pFld->GetTyp() );
                         if( pFldType != pFld->GetTyp() )
                         {
-                            SwFmtFld* pFmtFld = (SwFmtFld*)&((SwTxtFld*)pHint)->GetFmtFld();
+                            SwFmtFld* pFmtFld = const_cast<SwFmtFld*>(&pTxtFld->GetFmtFld());
                             pFmtFld->RegisterToFieldType( *pFldType );
                             pFmtFld->GetField()->ChgTyp( pFldType );
                         }
@@ -3076,7 +3084,10 @@ bool SwpHints::TryInsertHint(
 
                 case RES_POSTITFLD:
                     if ( pDoc->GetDocShell() )
-                        pDoc->GetDocShell()->Broadcast( SwFmtFldHint( &((SwTxtFld*)pHint)->GetFmtFld(), SwFmtFldHintWhich::INSERTED ) );
+                    {
+                        pDoc->GetDocShell()->Broadcast( SwFmtFldHint(
+                            &pTxtFld->GetFmtFld(), SwFmtFldHintWhich::INSERTED));
+                    }
                     break;
                 }
                 if( bInsFldType )
@@ -3088,7 +3099,7 @@ bool SwpHints::TryInsertHint(
         ((SwTxtFtn*)pHint)->ChgTxtNode( &rNode );
         break;
     case RES_TXTATR_REFMARK:
-        ((SwTxtRefMark*)pHint)->ChgTxtNode( &rNode );
+        static_txtattr_cast<SwTxtRefMark*>(pHint)->ChgTxtNode( &rNode );
         if( rNode.GetNodes().IsDocNodes() )
         {
             // search for a reference with the same name
@@ -3136,16 +3147,16 @@ bool SwpHints::TryInsertHint(
         }
         break;
     case RES_TXTATR_TOXMARK:
-        ((SwTxtTOXMark*)pHint)->ChgTxtNode( &rNode );
+        static_txtattr_cast<SwTxtTOXMark*>(pHint)->ChgTxtNode( &rNode );
         break;
 
     case RES_TXTATR_CJK_RUBY:
-        static_cast<SwTxtRuby*>(pHint)->InitRuby(rNode);
+        static_txtattr_cast<SwTxtRuby*>(pHint)->InitRuby(rNode);
         break;
 
     case RES_TXTATR_META:
     case RES_TXTATR_METAFIELD:
-        static_cast<SwTxtMeta *>(pHint)->ChgTxtNode( &rNode );
+        static_txtattr_cast<SwTxtMeta *>(pHint)->ChgTxtNode( &rNode );
         break;
 
     case RES_CHRATR_HIDDEN:
@@ -3204,7 +3215,7 @@ bool SwpHints::TryInsertHint(
     if (pHint->IsNesting())
     {
         const bool bRet(
-            TryInsertNesting(rNode, *static_cast<SwTxtAttrNesting*>(pHint)));
+            TryInsertNesting(rNode, *static_txtattr_cast<SwTxtAttrNesting*>(pHint)));
         if (!bRet) return false;
     }
     // Currently REFMARK and TOXMARK have OverlapAllowed set to true.
@@ -3246,7 +3257,7 @@ bool SwpHints::TryInsertHint(
         {
             // #i82989# Check sort numbers in NoHintAdjustMode
             if ( RES_TXTATR_CHARFMT == nWhich )
-                lcl_CheckSortNumber( *this, *static_cast<SwTxtCharFmt*>(pHint) );
+                lcl_CheckSortNumber(*this, *static_txtattr_cast<SwTxtCharFmt*>(pHint));
 
             SwpHintsArray::Insert( pHint );
             NoteInHistory( pHint, true );
@@ -3281,13 +3292,14 @@ void SwpHints::DeleteAtPos( const size_t nPos )
 
     if( pHint->Which() == RES_TXTATR_FIELD )
     {
-        const SwFieldType* pFldTyp = ((SwTxtFld*)pHint)->GetFmtFld().GetField()->GetTyp();
+        SwTxtFld *const pTxtFld(static_txtattr_cast<SwTxtFld*>(pHint));
+        const SwFieldType* pFldTyp = pTxtFld->GetFmtFld().GetField()->GetTyp();
         if( RES_DDEFLD == pFldTyp->Which() )
         {
-            const SwTxtNode* pNd = ((SwTxtFld*)pHint)->GetpTxtNode();
+            const SwTxtNode* pNd = pTxtFld->GetpTxtNode();
             if( pNd && pNd->GetNodes().IsDocNodes() )
                 ((SwDDEFieldType*)pFldTyp)->DecRefCnt();
-            ((SwTxtFld*)pHint)->ChgTxtNode( 0 );
+            pTxtFld->ChgTxtNode(0);
         }
         else if ( m_bHasHiddenParaField &&
                  RES_HIDDENPARAFLD == pFldTyp->Which() )
@@ -3297,7 +3309,9 @@ void SwpHints::DeleteAtPos( const size_t nPos )
     }
     else if ( pHint->Which() == RES_TXTATR_ANNOTATION )
     {
-        const_cast<SwFmtFld&>(((SwTxtFld*)pHint)->GetFmtFld()).Broadcast( SwFmtFldHint( &((SwTxtFld*)pHint)->GetFmtFld(), SwFmtFldHintWhich::REMOVED ) );
+        SwTxtFld *const pTxtFld(static_txtattr_cast<SwTxtFld*>(pHint));
+        const_cast<SwFmtFld&>(pTxtFld->GetFmtFld()).Broadcast(
+            SwFmtFldHint(&pTxtFld->GetFmtFld(), SwFmtFldHintWhich::REMOVED));
     }
 
     CalcFlags();
diff --git a/sw/source/core/txtnode/txtatr2.cxx b/sw/source/core/txtnode/txtatr2.cxx
index 9f5856fbcd2d..78edcb408cb7 100644
--- a/sw/source/core/txtnode/txtatr2.cxx
+++ b/sw/source/core/txtnode/txtatr2.cxx
@@ -40,7 +40,8 @@ TYPEINIT1(SwTxtRuby,SwClient);
 
 SwTxtCharFmt::SwTxtCharFmt( SwFmtCharFmt& rAttr,
                     sal_Int32 nStt, sal_Int32 nEnde )
-    : SwTxtAttrEnd( rAttr, nStt, nEnde )
+    : SwTxtAttr( rAttr, nStt )
+    , SwTxtAttrEnd( rAttr, nStt, nEnde )
     , m_pTxtNode( 0 )
     , m_nSortNumber( 0 )
 {
@@ -84,7 +85,8 @@ bool SwTxtCharFmt::GetInfo( SfxPoolItem& rInfo ) const
 
 SwTxtAttrNesting::SwTxtAttrNesting( SfxPoolItem & i_rAttr,
             const sal_Int32 i_nStart, const sal_Int32 i_nEnd )
-    : SwTxtAttrEnd( i_rAttr, i_nStart, i_nEnd )
+    : SwTxtAttr( i_rAttr, i_nStart )
+    , SwTxtAttrEnd( i_rAttr, i_nStart, i_nEnd )
 {
     SetDontExpand( true );  // never expand this attribute
     // lock the expand flag: simple guarantee that nesting will not be
@@ -100,7 +102,8 @@ SwTxtAttrNesting::~SwTxtAttrNesting()
 
 SwTxtINetFmt::SwTxtINetFmt( SwFmtINetFmt& rAttr,
                             sal_Int32 nStart, sal_Int32 nEnd )
-    : SwTxtAttrNesting( rAttr, nStart, nEnd )
+    : SwTxtAttr( rAttr, nStart )
+    , SwTxtAttrNesting( rAttr, nStart, nEnd )
     , SwClient( 0 )
     , m_pTxtNode( 0 )
     , m_bVisited( false )
@@ -202,7 +205,8 @@ bool SwTxtINetFmt::IsProtect( ) const
 
 SwTxtRuby::SwTxtRuby( SwFmtRuby& rAttr,
                       sal_Int32 nStart, sal_Int32 nEnd )
-    : SwTxtAttrNesting( rAttr, nStart, nEnd )
+    : SwTxtAttr( rAttr, nStart )
+    , SwTxtAttrNesting( rAttr, nStart, nEnd )
     , SwClient( 0 )
     , m_pTxtNode( 0 )
 {
@@ -305,7 +309,8 @@ SwTxtMeta::CreateTxtMeta(
 
 SwTxtMeta::SwTxtMeta( SwFmtMeta & i_rAttr,
         const sal_Int32 i_nStart, const sal_Int32 i_nEnd )
-    : SwTxtAttrNesting( i_rAttr, i_nStart, i_nEnd )
+    : SwTxtAttr( i_rAttr, i_nStart )
+    , SwTxtAttrNesting( i_rAttr, i_nStart, i_nEnd )
 {
     i_rAttr.SetTxtAttr( this );
     SetHasDummyChar(true);
diff --git a/sw/source/core/txtnode/txtedt.cxx b/sw/source/core/txtnode/txtedt.cxx
index a4616baf58da..d094b83442cb 100644
--- a/sw/source/core/txtnode/txtedt.cxx
+++ b/sw/source/core/txtnode/txtedt.cxx
@@ -609,7 +609,7 @@ void SwTxtNode::RstTxtAttr(
                         {
                             SwTxtCharFmt* pCharFmt = dynamic_cast<SwTxtCharFmt*>(pHt);
                             if ( pCharFmt )
-                                static_cast<SwTxtCharFmt*>(pNew)->SetSortNumber( pCharFmt->GetSortNumber() );
+                                static_txtattr_cast<SwTxtCharFmt*>(pNew)->SetSortNumber(pCharFmt->GetSortNumber());
 
                             InsertHint( pNew,
                                 nsSetAttrMode::SETATTR_NOHINTADJUST );
diff --git a/sw/source/core/undo/rolbck.cxx b/sw/source/core/undo/rolbck.cxx
index 3366de0279d7..a8429e8650be 100644
--- a/sw/source/core/undo/rolbck.cxx
+++ b/sw/source/core/undo/rolbck.cxx
@@ -1033,15 +1033,15 @@ void SwHistory::Add( SwTxtAttr* pHint, sal_uLong nNodeIdx, bool bNewAttr )
             case RES_TXTATR_FIELD:
             case RES_TXTATR_ANNOTATION:
                 pHt = new SwHistorySetTxtFld(
-                            static_cast<SwTxtFld*>(pHint), nNodeIdx );
+                        static_txtattr_cast<SwTxtFld*>(pHint), nNodeIdx);
                 break;
             case RES_TXTATR_TOXMARK:
                 pHt = new SwHistorySetTOXMark(
-                            static_cast<SwTxtTOXMark*>(pHint), nNodeIdx );
+                        static_txtattr_cast<SwTxtTOXMark*>(pHint), nNodeIdx);
                 break;
             case RES_TXTATR_REFMARK:
                 pHt = new SwHistorySetRefMark(
-                            static_cast<SwTxtRefMark*>(pHint), nNodeIdx );
+                        static_txtattr_cast<SwTxtRefMark*>(pHint), nNodeIdx);
                 break;
             default:
                 pHt = new SwHistorySetTxt(
diff --git a/sw/source/core/unocore/unoportenum.cxx b/sw/source/core/unocore/unoportenum.cxx
index 51fa87411d51..4d7477217cac 100644
--- a/sw/source/core/unocore/unoportenum.cxx
+++ b/sw/source/core/unocore/unoportenum.cxx
@@ -522,7 +522,7 @@ lcl_InsertRubyPortion(
     const SwTxtAttr & rAttr, const bool bEnd)
 {
     SwXTextPortion* pPortion = new SwXTextPortion(pUnoCrsr,
-            static_cast<const SwTxtRuby&>(rAttr), xParent, bEnd);
+            static_txtattr_cast<const SwTxtRuby&>(rAttr), xParent, bEnd);
     rPortions.push_back(pPortion);
     pPortion->SetCollapsed(rAttr.End() ? false : true);
 }
diff --git a/sw/source/filter/ascii/ascatr.cxx b/sw/source/filter/ascii/ascatr.cxx
index 7bea087b5b37..f5e497fe853f 100644
--- a/sw/source/filter/ascii/ascatr.cxx
+++ b/sw/source/filter/ascii/ascatr.cxx
@@ -137,7 +137,8 @@ bool SwASC_AttrIter::OutAttr( sal_Int32 nSwPos )
                 case RES_TXTATR_FIELD:
                 case RES_TXTATR_ANNOTATION:
                 case RES_TXTATR_INPUTFIELD:
-                    sOut = static_cast<SwTxtFld const*>(pHt)->GetFmtFld().GetField()->ExpandField(true);
+                    sOut = static_txtattr_cast<SwTxtFld const*>(pHt)
+                            ->GetFmtFld().GetField()->ExpandField(true);
                     break;
 
                 case RES_TXTATR_FTN: