These are pointers to offset to the top (necessary for multiple inheritance) and typeinfo pointers (RTTI).
From Itanium ABI (you are not using the Itanium compiler, but their description is really good):
The offset to the vertex contains the offset to the vertex of the object from the location within the pointer object of the virtual table, which refers to this virtual table as ptrdiff_t. It is always present. The offset allows you to find the top of the object from any base subobject using the pointer of the virtual table. This is necessary, in particular, for dynamic_cast.
(In the complete virtual table of the object and, therefore, in all its main basic virtual tables, the value of this offset will be zero. [...])
The typeinfo pointer points to the typeinfo object used for RTTI. It is always present. All records in each of the virtual tables for this class must point to the same typeinfo object. The correct implementation of typeinfo equality is to check the equality of pointers, with the exception of pointers (directly or indirectly) to incomplete types. The typeinfo pointer is a valid pointer for polymorphic classes, that is, classes with virtual functions, and is zero for non-polymorphic classes.
Top to top offset in more detail (on request)
Suppose you have a derived class D , derived from the base class B1 . What happens when you try to cast instance D to type B1 ? Since the function that accepts the B1 object knows nothing about D , part D virtual tables must also be valid B1 virtual tables. It's simple enough - just make the start of the D table look like a B1 Vtable and add all the additional entries we need after that. Functions waiting for B1 will be happy because they will not use any part of the vtable beyond what they expect for B1 .
However, what happens if D is also derived from B2 ? A pointer to D virtual tables cannot be both real B1 virtual tables and real B2 virtual tables! The compiler solves this problem by adding a separate B2 table B2 to the end of our combined D/B1 table D/B1 , and manually adjusts the pointer of the virtual table when we try to convert D to B2 .
However, this leads to a new problem - what happens when we try to return from B2 to D ? The compiler cannot simply set the vtable pointer in the opposite direction to the same amount that it adjusted the pointer earlier, because it actually does not know for sure that the B2 object we pass to it is of type D ! In particular, dynamic_cast<D>() should be able to determine whether our object is of type D or not. To do this, he needs access to the RTTI object, and for this he needs to know where the source vtable object is. This is the goal of the offset to the top value - it gives us the offset to the beginning of the original vtable object, we get our RTTI object, and the vengeful god C ++ allows our cultures to grow for another season.
There are some good examples of vtable layouts on this page (in Table 1c). Note that they are a bit more complicated due to the use of virtual inheritance , which adds an extra offset to the vtable of each child class.