Formally, of course, it's implementation defined, but in
practice, there will be an additional pointer in the vtable,
which points to a description of the object, probably as a DAG
of objects which contain pointers to the various children
(derived classes) and information regarding their type (a
pointer to a type_info
, perhaps).
The compiler then generates code which walks the different paths in the graph until it either finds the targeted type, or has visited all of the nodes. If it finds the targeted type, the node will also contain the necessary information as to how to convert the pointer.
EDIT:
One additional point occurs to me. Even if the generated code finds a match, it may have to continue navigating in order to ensure that it isn't ambiguous.