title: How are parameters passed in function calls in CIL?
body: <p>I am trying to learn CIL code, but not able to undertsand how return value of one function is passed as a parameter to another function. </p>
  
  <p>I have generated CIL code for the below function:</p>
  
  <pre><code>  public bool TestWebPage()
    {
      WebRequest request = WebRequest.Create("http://www.costco.com");
      request.Proxy.Credentials = CredentialCache.DefaultCredentials;
    }
  </code></pre>
  
  <p>CIL code:</p>
  
  <pre><code>//000021:     public void TestWebPage()
  //000022:     {
      IL_0000:  /* 00   |                  */ nop
     .line 23,23 : 7,71 ''
  //000023:       WebRequest request = WebRequest.Create("http://www.costco.com");
  IL_0001:  /* 72   | (70)000001       */ ldstr      "http://www.costco.com" /* 70000001  */
    IL_0006:  /* 28   | (0A)000012       */ call       class [System/*23000003*/]System.Net.WebRequest/*01000016*/ [System/*23000003*/]System.Net.WebRequest/*01000016*/::Create(string) /* 0A000012 */
    IL_000b:  /* 0A   |                  */ stloc.0
  .line 24,24 : 7,70 ''
  //000024:       request.Proxy.Credentials = CredentialCache.DefaultCredentials;
  IL_000c:  /* 06   |                  */ ldloc.0
  IL_000d:  /* 6F   | (0A)000013       */ callvirt   instance class [System/*23000003*/]System.Net.IWebProxy/*01000017*/ [System/*23000003*/]System.Net.WebRequest/*01000016*/::get_Proxy() /* 0A000013 */
  IL_0012:  /* 28   | (0A)000014       */ call       class [System/*23000003*/]System.Net.ICredentials/*01000019*/ [System/*23000003*/]System.Net.CredentialCache/*01000018*/::get_DefaultCredentials() /* 0A000014 */
  IL_0017:  /* 6F   | (0A)000015       */ callvirt   instance void [System/*23000003*/]System.Net.IWebProxy/*01000017*/::set_Credentials(class [System/*23000003*/]System.Net.ICredentials/*01000019*/) /* 0A000015 */
  IL_001c:  /* 00   |                  */ nop
  .line 25,25 : 7,73 ''
  </code></pre>
  
  <p>Specifically, I am not able to understand the following things in CIL code:</p>
  
  <ol>
  <li><p>How does the CLR runtime know that set_Credentials is to be passed the value returned from get_DefaultCredentials, since there does not seem to be any link other than the commented part "/<em>01000019</em>/"?</p></li>
  <li><p>How does CLR call get_Proxy on current instance of System.Net.WebRequest, i.e, is there a pointer to instance number in the CIL code?</p></li>
  </ol>