How are parameters passed in function calls in CIL?

Question

I am trying to learn CIL code, but not able to undertsand how return value of one function is passed as a parameter to another function.

I have generated CIL code for the below function:

  public bool TestWebPage()
  {
    WebRequest request = WebRequest.Create("http://www.costco.com");
    request.Proxy.Credentials = CredentialCache.DefaultCredentials;
  }

CIL code:

//000021:     public void TestWebPage()
//000022:     {
    IL_0000:  /* 00   |                  */ nop
   .line 23,23 : 7,71 ''
//000023:       WebRequest request = WebRequest.Create("http://www.costco.com");
IL_0001:  /* 72   | (70)000001       */ ldstr      "http://www.costco.com" /* 70000001  */
  IL_0006:  /* 28   | (0A)000012       */ call       class [System/*23000003*/]System.Net.WebRequest/*01000016*/ [System/*23000003*/]System.Net.WebRequest/*01000016*/::Create(string) /* 0A000012 */
  IL_000b:  /* 0A   |                  */ stloc.0
.line 24,24 : 7,70 ''
//000024:       request.Proxy.Credentials = CredentialCache.DefaultCredentials;
IL_000c:  /* 06   |                  */ ldloc.0
IL_000d:  /* 6F   | (0A)000013       */ callvirt   instance class [System/*23000003*/]System.Net.IWebProxy/*01000017*/ [System/*23000003*/]System.Net.WebRequest/*01000016*/::get_Proxy() /* 0A000013 */
IL_0012:  /* 28   | (0A)000014       */ call       class [System/*23000003*/]System.Net.ICredentials/*01000019*/ [System/*23000003*/]System.Net.CredentialCache/*01000018*/::get_DefaultCredentials() /* 0A000014 */
IL_0017:  /* 6F   | (0A)000015       */ callvirt   instance void [System/*23000003*/]System.Net.IWebProxy/*01000017*/::set_Credentials(class [System/*23000003*/]System.Net.ICredentials/*01000019*/) /* 0A000015 */
IL_001c:  /* 00   |                  */ nop
.line 25,25 : 7,73 ''

Specifically, I am not able to understand the following things in CIL code:

1. How does the CLR runtime know that set_Credentials is to be passed the value returned from get_DefaultCredentials, since there does not seem to be any link other than the commented part "/01000019/"?

2. How does CLR call get_Proxy on current instance of System.Net.WebRequest, i.e, is there a pointer to instance number in the CIL code?

Answer 1

Generally, they are passed on the stack - but note that this is largely an implementation detail ;p

1: the stack is built up such that the target is on the stack first = specifically:

• ldloc.0 loads request onto the stack
• callvirt get_Proxy() consumes request (since virtual) and leaves the proxy on the stack (from the return value)
• call get_DefaultCredentials() doesn't consume anything, and appends the default credentials
• callvirt set_Credentials consumes 2 values; the first (the proxy) is used as the instance (since virtual); the second (the credentials) is used as the first parameter value

2: In this case the instance is held in a "local" to the method (i.e. a reserved slot relative to the stack-frame); in this case, loc 0. In a release build, I would actually expect loc 0 to be removed, and this all handled simply without reserved slots; "dup" (to copy the reference as needed) would most-likely be used rather than stloc/ldloc.

Answer 2

1. The call instruction on IL_0012 pushes the return value of the get_DefaultCredentials onto the stack and the set_Credentials method on the next line is passed as argument the value onto the evaluation stack.
2. The request variable returned by the WebRequest.Create method is stored as a local variable at index 0 (stloc.0) and is then loaded by ldloc.0 so the get_Proxy method on line IL_000d is called on this local variable variable which has been loaded onto the evaluation stack.