... as reported by sberg via UBSan in CppunitTest_sw_mailmerge:

> sw/source/core/txtnode/thints.cxx:3207:38: runtime error: downcast of address 0x000003cadcb0 which does not point to an object of type 'SwTxtAttrNesting'
> 0x000003cadcb0: note: object is of type 'SwTxtInputFld'
> #0 in SwpHints::TryInsertHint(SwTxtAttr*, SwTxtNode&, unsigned short) sw/source/core/txtnode/thints.cxx:3207:13
> #1 in SwTxtNode::InsertHint(SwTxtAttr*, unsigned short) sw/source/core/txtnode/thints.cxx:1583:25
> #2 in SwTxtNode::SetAttr(SfxItemSet const&, int, int, unsigned short) sw/source/core/txtnode/thints.cxx:1943:39
> #3 in SwRegHistory::InsertItems(SfxItemSet const&, int, int, unsigned short) sw/source/core/undo/rolbck.cxx:1390:28
> #4 in (anonymous namespace)::lcl_InsAttr(SwDoc*, SwPaM const&, SfxItemSet const&, unsigned short, SwUndoAttr*, bool) sw/source/core/doc/DocumentContentOperationsManager.cxx:1169:28
> #5 in sw::DocumentContentOperationsManager::InsertPoolItem(SwPaM const&, SfxPoolItem const&, unsigned short, bool) sw/source/core/doc/DocumentContentOperationsManager.cxx:3041:23
> #6 in SwXTextField::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) sw/source/core/unocore/unofield.cxx:1966:13 > #7 in non-virtual thunk to SwXTextField::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) sw/source/core/unocore/unofield.cxx:2061:1

The SwTxtInputFld is unusual because it's both a field and has a range;
let's try to use virtual inheritance to inherit both from
SwTxtFld and SwTxtAttrNesting.  Sadly requires dynamic_cast everywhere.

Change-Id: I69f834d2b78ef7cdaac1f554bd80711084efcd02