sw: fix undefined casts of SwTxtInputFld

... as reported by sberg via UBSan in CppunitTest_sw_mailmerge:

> sw/source/core/txtnode/thints.cxx:3207:38: runtime error: downcast of address 0x000003cadcb0 which does not point to an object of type 'SwTxtAttrNesting'
> 0x000003cadcb0: note: object is of type 'SwTxtInputFld'
> #0 in SwpHints::TryInsertHint(SwTxtAttr*, SwTxtNode&, unsigned short) sw/source/core/txtnode/thints.cxx:3207:13
> #1 in SwTxtNode::InsertHint(SwTxtAttr*, unsigned short) sw/source/core/txtnode/thints.cxx:1583:25
> #2 in SwTxtNode::SetAttr(SfxItemSet const&, int, int, unsigned short) sw/source/core/txtnode/thints.cxx:1943:39
> #3 in SwRegHistory::InsertItems(SfxItemSet const&, int, int, unsigned short) sw/source/core/undo/rolbck.cxx:1390:28
> #4 in (anonymous namespace)::lcl_InsAttr(SwDoc*, SwPaM const&, SfxItemSet const&, unsigned short, SwUndoAttr*, bool) sw/source/core/doc/DocumentContentOperationsManager.cxx:1169:28
> #5 in sw::DocumentContentOperationsManager::InsertPoolItem(SwPaM const&, SfxPoolItem const&, unsigned short, bool) sw/source/core/doc/DocumentContentOperationsManager.cxx:3041:23
> #6 in SwXTextField::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) sw/source/core/unocore/unofield.cxx:1966:13 > #7 in non-virtual thunk to SwXTextField::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) sw/source/core/unocore/unofield.cxx:2061:1

The SwTxtInputFld is unusual because it's both a field and has a range;
let's try to use virtual inheritance to inherit both from
SwTxtFld and SwTxtAttrNesting.  Sadly requires dynamic_cast everywhere.

Change-Id: I69f834d2b78ef7cdaac1f554bd80711084efcd02

9 files changed, 97 insertions, 73 deletions

diff --git a/sw/source/core/txtnode/atrfld.cxx b/sw/source/core/txtnode/atrfld.cxx
index 828bc64b4a0f..6455a193aec9 100644
--- a/sw/source/core/txtnode/atrfld.cxx
+++ b/sw/source/core/txtnode/atrfld.cxx
@@ -329,6 +329,8 @@ bool SwFmtFld::IsProtect() const
            && mpTxtFld->GetpTxtNode()->IsProtect();
 }
 
+// class SwTxtFld ////////////////////////////////////////////////////
+
 SwTxtFld::SwTxtFld(
     SwFmtFld & rAttr,
     sal_Int32 const nStartPos,
@@ -501,6 +503,8 @@ void SwTxtFld::DeleteTxtFld( const SwTxtFld& rTxtFld )
     }
 }
 
+// class SwTxtInputFld ///////////////////////////////////////////////
+
 // input field in-place editing
 SwTxtInputFld::SwTxtInputFld(
     SwFmtFld & rAttr,
@@ -508,29 +512,19 @@ SwTxtInputFld::SwTxtInputFld(
     sal_Int32 const nEnd,
     bool const bInClipboard )
 
-    : SwTxtFld( rAttr, nStart, bInClipboard )
-    , m_nEnd( nEnd )
+    : SwTxtAttr( rAttr, nStart )
+    , SwTxtAttrNesting( rAttr, nStart, nEnd )
+    , SwTxtFld( rAttr, nStart, bInClipboard )
     , m_bLockNotifyContentChange( false )
 {
     SetHasDummyChar( false );
     SetHasContent( true );
-
-    SetDontExpand( true );
-    SetLockExpandFlag( true );
-    SetDontExpandStartAttr( true );
-
-    SetNesting( true );
 }
 
 SwTxtInputFld::~SwTxtInputFld()
 {
 }
 
-sal_Int32* SwTxtInputFld::GetEnd()
-{
-    return &m_nEnd;
-}
-
 void SwTxtInputFld::LockNotifyContentChange()
 {
     m_bLockNotifyContentChange = true;
@@ -602,12 +596,15 @@ void SwTxtInputFld::UpdateTextNodeContent( const OUString& rNewContent )
     GetTxtNode().ReplaceText( aIdx, nDelLen, rNewContent );
 }
 
+// class SwTxtAnnotationFld //////////////////////////////////////////
+
 // text annotation field
 SwTxtAnnotationFld::SwTxtAnnotationFld(
     SwFmtFld & rAttr,
     sal_Int32 const nStart,
     bool const bInClipboard )
-    : SwTxtFld( rAttr, nStart, bInClipboard )
+    : SwTxtAttr( rAttr, nStart )
+    , SwTxtFld( rAttr, nStart, bInClipboard )
 {
 }
 
diff --git a/sw/source/core/txtnode/atrref.cxx b/sw/source/core/txtnode/atrref.cxx
index 35f338b30e48..48c87a474656 100644
--- a/sw/source/core/txtnode/atrref.cxx
+++ b/sw/source/core/txtnode/atrref.cxx
@@ -75,7 +75,8 @@ void SwFmtRefMark::InvalidateRefMark()
 
 SwTxtRefMark::SwTxtRefMark( SwFmtRefMark& rAttr,
             sal_Int32 const nStartPos, sal_Int32 const*const pEnd)
-    : SwTxtAttrEnd( rAttr, nStartPos, nStartPos )
+    : SwTxtAttr(rAttr, nStartPos)
+    , SwTxtAttrEnd( rAttr, nStartPos, nStartPos )
     , m_pTxtNode( 0 )
     , m_pEnd( 0 )
 {
diff --git a/sw/source/core/txtnode/atrtox.cxx b/sw/source/core/txtnode/atrtox.cxx
index 81077385112f..1cbd87a94ac1 100644
--- a/sw/source/core/txtnode/atrtox.cxx
+++ b/sw/source/core/txtnode/atrtox.cxx
@@ -25,7 +25,8 @@
 
 SwTxtTOXMark::SwTxtTOXMark( SwTOXMark& rAttr,
             sal_Int32 const nStartPos, sal_Int32 const*const pEnd)
-    : SwTxtAttrEnd( rAttr, nStartPos, nStartPos )
+    : SwTxtAttr( rAttr, nStartPos )
+    , SwTxtAttrEnd( rAttr, nStartPos, nStartPos )
     , m_pTxtNode( 0 )
     , m_pEnd( 0 )
 {
diff --git a/sw/source/core/txtnode/modeltoviewhelper.cxx b/sw/source/core/txtnode/modeltoviewhelper.cxx
index 68a7cbb8b76e..ad268cdfccde 100644
--- a/sw/source/core/txtnode/modeltoviewhelper.cxx
+++ b/sw/source/core/txtnode/modeltoviewhelper.cxx
@@ -149,7 +149,7 @@ ModelToViewHelper::ModelToViewHelper(const SwTxtNode &rNode, sal_uInt16 eMode)
                             {
                                 aFieldResult.m_sExpand = (eMode & REPLACEMODE)
                                     ? OUString(CHAR_ZWSP)
-                                    : static_cast<SwTxtFld const*>(pAttr)->
+                                    : static_txtattr_cast<SwTxtFld const*>(pAttr)->
                                       GetFmtFld().GetField()->ExpandField(true);
                                 aFieldResult.m_eType = FieldResult::FIELD;
                             }
diff --git a/sw/source/core/txtnode/ndhints.cxx b/sw/source/core/txtnode/ndhints.cxx
index ea5f4d8a7ba4..200f2114b1be 100644
--- a/sw/source/core/txtnode/ndhints.cxx
+++ b/sw/source/core/txtnode/ndhints.cxx
@@ -44,8 +44,10 @@ static bool lcl_IsLessStart( const SwTxtAttr &rHt1, const SwTxtAttr &rHt2 )
             {
                 if ( RES_TXTATR_CHARFMT == nWhich1 )
                 {
-                    const sal_uInt16 nS1 = static_cast<const SwTxtCharFmt&>(rHt1).GetSortNumber();
-                    const sal_uInt16 nS2 = static_cast<const SwTxtCharFmt&>(rHt2).GetSortNumber();
+                    const sal_uInt16 nS1 =
+                        static_txtattr_cast<const SwTxtCharFmt&>(rHt1).GetSortNumber();
+                    const sal_uInt16 nS2 =
+                        static_txtattr_cast<const SwTxtCharFmt&>(rHt2).GetSortNumber();
                     if ( nS1 != nS2 ) // robust
                         return nS1 < nS2;
                 }
@@ -75,8 +77,10 @@ static bool lcl_IsLessEnd( const SwTxtAttr &rHt1, const SwTxtAttr &rHt2 )
             {
                 if ( RES_TXTATR_CHARFMT == nWhich1 )
                 {
-                    const sal_uInt16 nS1 = static_cast<const SwTxtCharFmt&>(rHt1).GetSortNumber();
-                    const sal_uInt16 nS2 = static_cast<const SwTxtCharFmt&>(rHt2).GetSortNumber();
+                    const sal_uInt16 nS1 =
+                        static_txtattr_cast<const SwTxtCharFmt&>(rHt1).GetSortNumber();
+                    const sal_uInt16 nS2 =
+                        static_txtattr_cast<const SwTxtCharFmt&>(rHt2).GetSortNumber();
                     if ( nS1 != nS2 ) // robust
                         return nS1 > nS2;
                 }
@@ -257,9 +261,9 @@ bool SwpHintsArray::Check(bool bPortionsMerged) const
                     ) // never two AUTOFMT on same range
                 &&  (   (pHtThis->Which() != RES_TXTATR_CHARFMT)
                     ||  (pHtLast->Which() != RES_TXTATR_CHARFMT)
-                    ||  (static_cast<const SwTxtCharFmt *>(pHtThis)
+                    ||  (static_txtattr_cast<const SwTxtCharFmt *>(pHtThis)
                                 ->GetSortNumber() !=
-                         static_cast<const SwTxtCharFmt *>(pHtLast)
+                         static_txtattr_cast<const SwTxtCharFmt *>(pHtLast)
                                 ->GetSortNumber())
                     ) // multiple CHARFMT on same range need distinct sortnr
                 )
diff --git a/sw/source/core/txtnode/ndtxt.cxx b/sw/source/core/txtnode/ndtxt.cxx
index 5f9f95ccf233..59793051e238 100644
--- a/sw/source/core/txtnode/ndtxt.cxx
+++ b/sw/source/core/txtnode/ndtxt.cxx
@@ -1406,7 +1406,8 @@ void lcl_CopyHint(
         {
             if( pOtherDoc != NULL )
             {
-                static_cast<const SwTxtFld*>(pHt)->CopyTxtFld( static_cast<SwTxtFld*>(pNewHt) );
+                static_txtattr_cast<const SwTxtFld*>(pHt)->CopyTxtFld(
+                        static_txtattr_cast<SwTxtFld*>(pNewHt));
             }
 
             // Tabellenformel ??
@@ -1416,7 +1417,7 @@ void lcl_CopyHint(
             {
                 // wandel die interne in eine externe Formel um
                 const SwTableNode* const pDstTblNd =
-                    static_cast<const SwTxtFld*>(pHt)->GetTxtNode().FindTableNode();
+                    static_txtattr_cast<const SwTxtFld*>(pHt)->GetTxtNode().FindTableNode();
                 if( pDstTblNd )
                 {
                     SwTblField* const pTblFld =
@@ -1432,7 +1433,8 @@ void lcl_CopyHint(
     case RES_TXTATR_ANNOTATION :
         if( pOtherDoc != NULL )
         {
-            static_cast<const SwTxtFld*>(pHt)->CopyTxtFld( static_cast<SwTxtFld*>(pNewHt) );
+            static_txtattr_cast<const SwTxtFld*>(pHt)->CopyTxtFld(
+                    static_txtattr_cast<SwTxtFld*>(pNewHt));
         }
         break;
 
@@ -1442,7 +1444,7 @@ void lcl_CopyHint(
         {
             // Beim Kopieren von TOXMarks(Client) in andere Dokumente
             // muss der Verzeichnis (Modify) ausgetauscht werden
-            static_cast<SwTxtTOXMark*>(pNewHt)->CopyTOXMark( pOtherDoc );
+            static_txtattr_cast<SwTxtTOXMark*>(pNewHt)->CopyTOXMark(pOtherDoc);
         }
         break;
 
@@ -1470,8 +1472,8 @@ void lcl_CopyHint(
             if( pOtherDoc && pDest && pDest->GetpSwpHints()
                 && pDest->GetpSwpHints()->Contains( pNewHt ) )
             {
-                const SwDoc* const pDoc = static_cast<const SwTxtINetFmt*>(pHt)
-                    ->GetTxtNode().GetDoc();
+                const SwDoc* const pDoc = static_txtattr_cast<
+                        const SwTxtINetFmt*>(pHt)->GetTxtNode().GetDoc();
                 if ( pDoc )
                 {
                     const SwCharFmts* pCharFmts = pDoc->GetCharFmts();
@@ -1488,7 +1490,7 @@ void lcl_CopyHint(
             //JP 24.04.98: Bug 49753 - ein TextNode muss am Attribut
             //              gesetzt sein, damit die Vorlagen erzeugt
             //              werden koenne
-            SwTxtINetFmt* const pINetHt = static_cast<SwTxtINetFmt*>(pNewHt);
+            SwTxtINetFmt *const pINetHt = static_txtattr_cast<SwTxtINetFmt*>(pNewHt);
             if ( !pINetHt->GetpTxtNode() )
             {
                 pINetHt->ChgTxtNode( pDest );
@@ -3030,7 +3032,7 @@ static void Replace0xFF(
                         if( bExpandFlds )
                         {
                             const OUString aExpand(
-                                static_cast<SwTxtFld const*>(pAttr)->GetFmtFld().GetField()->ExpandField(true));
+                                static_txtattr_cast<SwTxtFld const*>(pAttr)->GetFmtFld().GetField()->ExpandField(true));
                             rTxt.insert(nPos, aExpand);
                             nPos = nPos + aExpand.getLength();
                             nEndPos = nEndPos + aExpand.getLength();
@@ -3196,7 +3198,7 @@ bool SwTxtNode::GetExpandTxt( SwTxtNode& rDestNd, const SwIndex* pDestIdx,
                 case RES_TXTATR_ANNOTATION:
                     {
                         OUString const aExpand(
-                            static_cast<SwTxtFld const*>(pHt)->GetFmtFld().GetField()->ExpandField(true) );
+                            static_txtattr_cast<SwTxtFld const*>(pHt)->GetFmtFld().GetField()->ExpandField(true));
                         if (!aExpand.isEmpty())
                         {
                             ++aDestIdx;     // dahinter einfuegen;
diff --git a/sw/source/core/txtnode/thints.cxx b/sw/source/core/txtnode/thints.cxx
index 5e49b5a0df80..a38fae5de72f 100644
--- a/sw/source/core/txtnode/thints.cxx
+++ b/sw/source/core/txtnode/thints.cxx
@@ -105,7 +105,7 @@ struct TxtAttrDeleter
         if (RES_TXTATR_META == pAttr->Which() ||
             RES_TXTATR_METAFIELD == pAttr->Which())
         {
-            static_cast<SwTxtMeta *>(pAttr)->ChgTxtNode(0); // prevents ASSERT
+            static_txtattr_cast<SwTxtMeta *>(pAttr)->ChgTxtNode(0); // prevents ASSERT
         }
         SwTxtAttr::Destroy( pAttr, m_rPool );
     }
@@ -237,19 +237,19 @@ MakeTxtAttrNesting(SwTxtNode & rNode, SwTxtAttrNesting & rNesting,
     {
         case RES_TXTATR_INETFMT:
         {
-            static_cast<SwTxtINetFmt*>(pNew)->InitINetFmt(rNode);
+            static_txtattr_cast<SwTxtINetFmt*>(pNew)->InitINetFmt(rNode);
             break;
         }
         case RES_TXTATR_CJK_RUBY:
         {
-            static_cast<SwTxtRuby*>(pNew)->InitRuby(rNode);
+            static_txtattr_cast<SwTxtRuby*>(pNew)->InitRuby(rNode);
             break;
         }
         default:
             OSL_FAIL("MakeTxtAttrNesting: what the hell is that?");
             break;
     }
-    return static_cast<SwTxtAttrNesting*>(pNew);
+    return static_txtattr_cast<SwTxtAttrNesting*>(pNew);
 }
 
 typedef ::std::vector<SwTxtAttrNesting *> NestList_t;
@@ -400,7 +400,7 @@ SwpHints::TryInsertNesting( SwTxtNode & rNode, SwTxtAttrNesting & rNewHint )
                         break;
                     case SPLIT_OTHER:
                         OverlappingExisting.push_back(
-                            static_cast<SwTxtAttrNesting*>(pOther));
+                            static_txtattr_cast<SwTxtAttrNesting*>(pOther));
                         break;
                     default:
                         OSL_FAIL("bad code monkey");
@@ -413,7 +413,7 @@ SwpHints::TryInsertNesting( SwTxtNode & rNode, SwTxtAttrNesting & rNewHint )
                 {
                 // ruby and hyperlink: if there is nesting, _overwrite_
                 OverwrittenExisting.push_back(
-                    static_cast<SwTxtAttrNesting*>(pOther));
+                    static_txtattr_cast<SwTxtAttrNesting*>(pOther));
                 }
                 else if ((nNewStart == nOtherStart) && pOther->HasDummyChar())
                 {
@@ -620,7 +620,10 @@ void SwpHints::BuildPortions( SwTxtNode& rNode, SwTxtAttr& rNewHint,
                 SwTxtAttr* pNewAttr = MakeTxtAttr( *rNode.GetDoc(),
                         pOther->GetAttr(), nOtherStart, nThisStart );
                 if ( RES_TXTATR_CHARFMT == pOther->Which() )
-                    static_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber( static_cast<SwTxtCharFmt*>(pOther)->GetSortNumber() );
+                {
+                    static_txtattr_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber(
+                        static_txtattr_cast<SwTxtCharFmt*>(pOther)->GetSortNumber() );
+                }
                 aInsDelHints.push_back( pNewAttr );
 
                 NoteInHistory( pOther );
@@ -637,7 +640,10 @@ void SwpHints::BuildPortions( SwTxtNode& rNode, SwTxtAttr& rNewHint,
                 SwTxtAttr* pNewAttr = MakeTxtAttr( *rNode.GetDoc(),
                         pOther->GetAttr(), nOtherStart, nThisEnd );
                 if ( RES_TXTATR_CHARFMT == pOther->Which() )
-                    static_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber( static_cast<SwTxtCharFmt*>(pOther)->GetSortNumber() );
+                {
+                    static_txtattr_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber(
+                        static_txtattr_cast<SwTxtCharFmt*>(pOther)->GetSortNumber());
+                }
                 aInsDelHints.push_back( pNewAttr );
 
                 NoteInHistory( pOther );
@@ -806,7 +812,7 @@ void SwpHints::BuildPortions( SwTxtNode& rNode, SwTxtAttr& rNewHint,
             {
                 pNewAttr = MakeTxtAttr( *rNode.GetDoc(), rNewHint.GetAttr(),
                         nPorStart, nPorEnd );
-                static_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber( nCharStyleCount );
+                static_txtattr_cast<SwTxtCharFmt*>(pNewAttr)->SetSortNumber(nCharStyleCount);
             }
         }
         else
@@ -1140,13 +1146,14 @@ void SwTxtNode::DestroyAttr( SwTxtAttr* pAttr )
         case RES_TXTATR_INPUTFIELD:
             if( !pDoc->IsInDtor() )
             {
+                SwTxtFld *const pTxtFld(static_txtattr_cast<SwTxtFld*>(pAttr));
                 // Wenn wir ein HiddenParaField sind, dann muessen wir
                 // ggf. fuer eine Neuberechnung des Visible-Flags sorgen.
                 const SwField* pFld = pAttr->GetFmtFld().GetField();
 
                 //JP 06-08-95: DDE-Felder bilden eine Ausnahme
                 OSL_ENSURE( RES_DDEFLD == pFld->GetTyp()->Which() ||
-                        this == ((SwTxtFld*)pAttr)->GetpTxtNode(),
+                        this == pTxtFld->GetpTxtNode(),
                         "Wo steht denn dieses Feld?" );
 
                 // bestimmte Felder mussen am Doc das Calculations-Flag updaten
@@ -1163,16 +1170,16 @@ void SwTxtNode::DestroyAttr( SwTxtAttr* pAttr )
                 case RES_DBNUMSETFLD:
                 case RES_DBNEXTSETFLD:
                     if( !pDoc->getIDocumentFieldsAccess().IsNewFldLst() && GetNodes().IsDocNodes() )
-                        pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst( false, *(SwTxtFld*)pAttr );
+                        pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst(false, *pTxtFld);
                     break;
                 case RES_DDEFLD:
-                    if( GetNodes().IsDocNodes() &&
-                        ((SwTxtFld*)pAttr)->GetpTxtNode() )
+                    if (GetNodes().IsDocNodes() && pTxtFld->GetpTxtNode())
                         ((SwDDEFieldType*)pFld->GetTyp())->DecRefCnt();
                     break;
                 case RES_POSTITFLD:
                     {
-                        const_cast<SwFmtFld&>(pAttr->GetFmtFld()).Broadcast( SwFmtFldHint( &((SwTxtFld*)pAttr)->GetFmtFld(), SwFmtFldHintWhich::REMOVED ) );
+                        const_cast<SwFmtFld&>(pAttr->GetFmtFld()).Broadcast(
+                            SwFmtFldHint(&pTxtFld->GetFmtFld(), SwFmtFldHintWhich::REMOVED));
                         break;
                     }
                 }
@@ -1190,7 +1197,7 @@ void SwTxtNode::DestroyAttr( SwTxtAttr* pAttr )
 
         case RES_TXTATR_META:
         case RES_TXTATR_METAFIELD:
-            static_cast<SwTxtMeta*>(pAttr)->ChgTxtNode(0);
+            static_txtattr_cast<SwTxtMeta*>(pAttr)->ChgTxtNode(0);
             break;
 
         default:
@@ -2921,7 +2928,7 @@ static void lcl_CheckSortNumber( const SwpHints& rHints, SwTxtCharFmt& rNewCharF
 
             if ( nOtherStart == nHtStart && nOtherEnd == nHtEnd )
             {
-                nSortNumber = static_cast<const SwTxtCharFmt*>(pOtherHt)->GetSortNumber() + 1;
+                nSortNumber = static_txtattr_cast<const SwTxtCharFmt*>(pOtherHt)->GetSortNumber() + 1;
             }
         }
     }
@@ -2968,7 +2975,7 @@ bool SwpHints::TryInsertHint(
         if ( SfxItemState::SET == pFmt->GetItemState( RES_CHRATR_HIDDEN, true, &pItem ) )
             rNode.SetCalcHiddenCharFlags();
 
-        ((SwTxtCharFmt*)pHint)->ChgTxtNode( &rNode );
+        static_txtattr_cast<SwTxtCharFmt*>(pHint)->ChgTxtNode( &rNode );
         break;
     }
     // #i75430# Recalc hidden flags if necessary
@@ -3003,17 +3010,18 @@ bool SwpHints::TryInsertHint(
         break;
     }
     case RES_TXTATR_INETFMT:
-        static_cast<SwTxtINetFmt*>(pHint)->InitINetFmt(rNode);
+        static_txtattr_cast<SwTxtINetFmt*>(pHint)->InitINetFmt(rNode);
         break;
 
     case RES_TXTATR_FIELD:
     case RES_TXTATR_ANNOTATION:
     case RES_TXTATR_INPUTFIELD:
         {
-            bool bDelFirst = 0 != ((SwTxtFld*)pHint)->GetpTxtNode();
-            ((SwTxtFld*)pHint)->ChgTxtNode( &rNode );
+            SwTxtFld *const pTxtFld(static_txtattr_cast<SwTxtFld*>(pHint));
+            bool bDelFirst = 0 != pTxtFld->GetpTxtNode();
+            pTxtFld->ChgTxtNode( &rNode );
             SwDoc* pDoc = rNode.GetDoc();
-            const SwField* pFld = ((SwTxtFld*)pHint)->GetFmtFld().GetField();
+            const SwField* pFld = pTxtFld->GetFmtFld().GetField();
 
             if( !pDoc->getIDocumentFieldsAccess().IsNewFldLst() )
             {
@@ -3029,9 +3037,9 @@ bool SwpHints::TryInsertHint(
                 case RES_DBNEXTSETFLD:
                     {
                         if( bDelFirst )
-                            pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst( false, *(SwTxtFld*)pHint );
+                            pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst(false, *pTxtFld);
                         if( rNode.GetNodes().IsDocNodes() )
-                            pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst( true, *(SwTxtFld*)pHint );
+                            pDoc->getIDocumentFieldsAccess().InsDelFldInFldLst(true, *pTxtFld);
                     }
                     break;
                 case RES_DDEFLD:
@@ -3057,7 +3065,7 @@ bool SwpHints::TryInsertHint(
                                     pDoc->getIDocumentFieldsAccess().InsertFldType( *pFld->GetTyp() );
                         if( pFldType != pFld->GetTyp() )
                         {
-                            SwFmtFld* pFmtFld = (SwFmtFld*)&((SwTxtFld*)pHint)->GetFmtFld();
+                            SwFmtFld* pFmtFld = const_cast<SwFmtFld*>(&pTxtFld->GetFmtFld());
                             pFmtFld->RegisterToFieldType( *pFldType );
                             pFmtFld->GetField()->ChgTyp( pFldType );
                         }
@@ -3076,7 +3084,10 @@ bool SwpHints::TryInsertHint(
 
                 case RES_POSTITFLD:
                     if ( pDoc->GetDocShell() )
-                        pDoc->GetDocShell()->Broadcast( SwFmtFldHint( &((SwTxtFld*)pHint)->GetFmtFld(), SwFmtFldHintWhich::INSERTED ) );
+                    {
+                        pDoc->GetDocShell()->Broadcast( SwFmtFldHint(
+                            &pTxtFld->GetFmtFld(), SwFmtFldHintWhich::INSERTED));
+                    }
                     break;
                 }
                 if( bInsFldType )
@@ -3088,7 +3099,7 @@ bool SwpHints::TryInsertHint(
         ((SwTxtFtn*)pHint)->ChgTxtNode( &rNode );
         break;
     case RES_TXTATR_REFMARK:
-        ((SwTxtRefMark*)pHint)->ChgTxtNode( &rNode );
+        static_txtattr_cast<SwTxtRefMark*>(pHint)->ChgTxtNode( &rNode );
         if( rNode.GetNodes().IsDocNodes() )
         {
             // search for a reference with the same name
@@ -3136,16 +3147,16 @@ bool SwpHints::TryInsertHint(
         }
         break;
     case RES_TXTATR_TOXMARK:
-        ((SwTxtTOXMark*)pHint)->ChgTxtNode( &rNode );
+        static_txtattr_cast<SwTxtTOXMark*>(pHint)->ChgTxtNode( &rNode );
         break;
 
     case RES_TXTATR_CJK_RUBY:
-        static_cast<SwTxtRuby*>(pHint)->InitRuby(rNode);
+        static_txtattr_cast<SwTxtRuby*>(pHint)->InitRuby(rNode);
         break;
 
     case RES_TXTATR_META:
     case RES_TXTATR_METAFIELD:
-        static_cast<SwTxtMeta *>(pHint)->ChgTxtNode( &rNode );
+        static_txtattr_cast<SwTxtMeta *>(pHint)->ChgTxtNode( &rNode );
         break;
 
     case RES_CHRATR_HIDDEN:
@@ -3204,7 +3215,7 @@ bool SwpHints::TryInsertHint(
     if (pHint->IsNesting())
     {
         const bool bRet(
-            TryInsertNesting(rNode, *static_cast<SwTxtAttrNesting*>(pHint)));
+            TryInsertNesting(rNode, *static_txtattr_cast<SwTxtAttrNesting*>(pHint)));
         if (!bRet) return false;
     }
     // Currently REFMARK and TOXMARK have OverlapAllowed set to true.
@@ -3246,7 +3257,7 @@ bool SwpHints::TryInsertHint(
         {
             // #i82989# Check sort numbers in NoHintAdjustMode
             if ( RES_TXTATR_CHARFMT == nWhich )
-                lcl_CheckSortNumber( *this, *static_cast<SwTxtCharFmt*>(pHint) );
+                lcl_CheckSortNumber(*this, *static_txtattr_cast<SwTxtCharFmt*>(pHint));
 
             SwpHintsArray::Insert( pHint );
             NoteInHistory( pHint, true );
@@ -3281,13 +3292,14 @@ void SwpHints::DeleteAtPos( const size_t nPos )
 
     if( pHint->Which() == RES_TXTATR_FIELD )
     {
-        const SwFieldType* pFldTyp = ((SwTxtFld*)pHint)->GetFmtFld().GetField()->GetTyp();
+        SwTxtFld *const pTxtFld(static_txtattr_cast<SwTxtFld*>(pHint));
+        const SwFieldType* pFldTyp = pTxtFld->GetFmtFld().GetField()->GetTyp();
         if( RES_DDEFLD == pFldTyp->Which() )
         {
-            const SwTxtNode* pNd = ((SwTxtFld*)pHint)->GetpTxtNode();
+            const SwTxtNode* pNd = pTxtFld->GetpTxtNode();
             if( pNd && pNd->GetNodes().IsDocNodes() )
                 ((SwDDEFieldType*)pFldTyp)->DecRefCnt();
-            ((SwTxtFld*)pHint)->ChgTxtNode( 0 );
+            pTxtFld->ChgTxtNode(0);
         }
         else if ( m_bHasHiddenParaField &&
                  RES_HIDDENPARAFLD == pFldTyp->Which() )
@@ -3297,7 +3309,9 @@ void SwpHints::DeleteAtPos( const size_t nPos )
     }
     else if ( pHint->Which() == RES_TXTATR_ANNOTATION )
     {
-        const_cast<SwFmtFld&>(((SwTxtFld*)pHint)->GetFmtFld()).Broadcast( SwFmtFldHint( &((SwTxtFld*)pHint)->GetFmtFld(), SwFmtFldHintWhich::REMOVED ) );
+        SwTxtFld *const pTxtFld(static_txtattr_cast<SwTxtFld*>(pHint));
+        const_cast<SwFmtFld&>(pTxtFld->GetFmtFld()).Broadcast(
+            SwFmtFldHint(&pTxtFld->GetFmtFld(), SwFmtFldHintWhich::REMOVED));
     }
 
     CalcFlags();
diff --git a/sw/source/core/txtnode/txtatr2.cxx b/sw/source/core/txtnode/txtatr2.cxx
index 9f5856fbcd2d..78edcb408cb7 100644
--- a/sw/source/core/txtnode/txtatr2.cxx
+++ b/sw/source/core/txtnode/txtatr2.cxx
@@ -40,7 +40,8 @@ TYPEINIT1(SwTxtRuby,SwClient);
 
 SwTxtCharFmt::SwTxtCharFmt( SwFmtCharFmt& rAttr,
                     sal_Int32 nStt, sal_Int32 nEnde )
-    : SwTxtAttrEnd( rAttr, nStt, nEnde )
+    : SwTxtAttr( rAttr, nStt )
+    , SwTxtAttrEnd( rAttr, nStt, nEnde )
     , m_pTxtNode( 0 )
     , m_nSortNumber( 0 )
 {
@@ -84,7 +85,8 @@ bool SwTxtCharFmt::GetInfo( SfxPoolItem& rInfo ) const
 
 SwTxtAttrNesting::SwTxtAttrNesting( SfxPoolItem & i_rAttr,
             const sal_Int32 i_nStart, const sal_Int32 i_nEnd )
-    : SwTxtAttrEnd( i_rAttr, i_nStart, i_nEnd )
+    : SwTxtAttr( i_rAttr, i_nStart )
+    , SwTxtAttrEnd( i_rAttr, i_nStart, i_nEnd )
 {
     SetDontExpand( true );  // never expand this attribute
     // lock the expand flag: simple guarantee that nesting will not be
@@ -100,7 +102,8 @@ SwTxtAttrNesting::~SwTxtAttrNesting()
 
 SwTxtINetFmt::SwTxtINetFmt( SwFmtINetFmt& rAttr,
                             sal_Int32 nStart, sal_Int32 nEnd )
-    : SwTxtAttrNesting( rAttr, nStart, nEnd )
+    : SwTxtAttr( rAttr, nStart )
+    , SwTxtAttrNesting( rAttr, nStart, nEnd )
     , SwClient( 0 )
     , m_pTxtNode( 0 )
     , m_bVisited( false )
@@ -202,7 +205,8 @@ bool SwTxtINetFmt::IsProtect( ) const
 
 SwTxtRuby::SwTxtRuby( SwFmtRuby& rAttr,
                       sal_Int32 nStart, sal_Int32 nEnd )
-    : SwTxtAttrNesting( rAttr, nStart, nEnd )
+    : SwTxtAttr( rAttr, nStart )
+    , SwTxtAttrNesting( rAttr, nStart, nEnd )
     , SwClient( 0 )
     , m_pTxtNode( 0 )
 {
@@ -305,7 +309,8 @@ SwTxtMeta::CreateTxtMeta(
 
 SwTxtMeta::SwTxtMeta( SwFmtMeta & i_rAttr,
         const sal_Int32 i_nStart, const sal_Int32 i_nEnd )
-    : SwTxtAttrNesting( i_rAttr, i_nStart, i_nEnd )
+    : SwTxtAttr( i_rAttr, i_nStart )
+    , SwTxtAttrNesting( i_rAttr, i_nStart, i_nEnd )
 {
     i_rAttr.SetTxtAttr( this );
     SetHasDummyChar(true);
diff --git a/sw/source/core/txtnode/txtedt.cxx b/sw/source/core/txtnode/txtedt.cxx
index a4616baf58da..d094b83442cb 100644
--- a/sw/source/core/txtnode/txtedt.cxx
+++ b/sw/source/core/txtnode/txtedt.cxx
@@ -609,7 +609,7 @@ void SwTxtNode::RstTxtAttr(
                         {
                             SwTxtCharFmt* pCharFmt = dynamic_cast<SwTxtCharFmt*>(pHt);
                             if ( pCharFmt )
-                                static_cast<SwTxtCharFmt*>(pNew)->SetSortNumber( pCharFmt->GetSortNumber() );
+                                static_txtattr_cast<SwTxtCharFmt*>(pNew)->SetSortNumber(pCharFmt->GetSortNumber());
 
                             InsertHint( pNew,
                                 nsSetAttrMode::SETATTR_NOHINTADJUST );