diff --git a/tools/widl/client.c b/tools/widl/client.c
index 7f2a8064648..0796ba446ef 100644
--- a/tools/widl/client.c
+++ b/tools/widl/client.c
@@ -128,8 +128,8 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
             }
         }
 
-        write_type_decl_left(client, def->type);
-        if (needs_space_after(def->type))
+        write_type_decl_left(client, get_func_return_type(func));
+        if (needs_space_after(get_func_return_type(func)))
           fprintf(client, " ");
         write_prefix_name(client, prefix_client, def);
         fprintf(client, "(\n");
@@ -146,10 +146,10 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
         indent++;
 
         /* declare return value '_RetVal' */
-        if (!is_void(def->type))
+        if (!is_void(get_func_return_type(func)))
         {
             print_client("");
-            write_type_decl_left(client, def->type);
+            write_type_decl_left(client, get_func_return_type(func));
             fprintf(client, " _RetVal;\n");
         }
 
@@ -158,7 +158,7 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
 
         print_client("RPC_MESSAGE _RpcMessage;\n");
         print_client("MIDL_STUB_MESSAGE _StubMsg;\n");
-        if (!is_void(def->type) && decl_indirect(def->type))
+        if (!is_void(get_func_return_type(func)) && decl_indirect(get_func_return_type(func)))
         {
             print_client("void *_p_%s = &%s;\n",
                          "_RetVal", "_RetVal");
@@ -261,11 +261,11 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
         write_remoting_arguments(client, indent, func, PASS_OUT, PHASE_UNMARSHAL);
 
         /* unmarshal return value */
-        if (!is_void(def->type))
+        if (!is_void(get_func_return_type(func)))
         {
-            if (decl_indirect(def->type))
+            if (decl_indirect(get_func_return_type(func)))
                 print_client("MIDL_memset(&%s, 0, sizeof(%s));\n", "_RetVal", "_RetVal");
-            else if (is_ptr(def->type) || is_array(def->type))
+            else if (is_ptr(get_func_return_type(func)) || is_array(get_func_return_type(func)))
                 print_client("%s = 0;\n", "_RetVal");
             write_remoting_arguments(client, indent, func, PASS_RETURN, PHASE_UNMARSHAL);
         }
@@ -274,10 +274,10 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
         if (func->args)
         {
             LIST_FOR_EACH_ENTRY( var, func->args, const var_t, entry )
-                *proc_offset += get_size_procformatstring_var(var);
+                *proc_offset += get_size_procformatstring_type(var->name, var->type, var->attrs);
         }
-        if (!is_void(def->type))
-            *proc_offset += get_size_procformatstring_var(def);
+        if (!is_void(get_func_return_type(func)))
+            *proc_offset += get_size_procformatstring_type("return value", get_func_return_type(func), NULL);
         else
             *proc_offset += 2; /* FC_END and FC_PAD */
 
@@ -312,7 +312,7 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
 
 
         /* emit return code */
-        if (!is_void(def->type))
+        if (!is_void(get_func_return_type(func)))
         {
             fprintf(client, "\n");
             print_client("return _RetVal;\n");
diff --git a/tools/widl/header.c b/tools/widl/header.c
index f1e5a035d9e..1e3bf467be3 100644
--- a/tools/widl/header.c
+++ b/tools/widl/header.c
@@ -599,7 +599,7 @@ int has_out_arg_or_return(const func_t *func)
 {
     const var_t *var;
 
-    if (!is_void(func->def->type))
+    if (!is_void(get_func_return_type(func)))
         return 1;
 
     if (!func->args)
@@ -718,7 +718,7 @@ static void write_cpp_method_def(const type_t *iface)
     if (!is_callas(def->attrs)) {
       indent(header, 0);
       fprintf(header, "virtual ");
-      write_type_decl_left(header, def->type);
+      write_type_decl_left(header, get_func_return_type(cur));
       fprintf(header, " STDMETHODCALLTYPE ");
       write_name(header, def);
       fprintf(header, "(\n");
@@ -743,7 +743,7 @@ static void do_write_c_method_def(const type_t *iface, const char *name)
     const var_t *def = cur->def;
     if (!is_callas(def->attrs)) {
       indent(header, 0);
-      write_type_decl_left(header, def->type);
+      write_type_decl_left(header, get_func_return_type(cur));
       fprintf(header, " (STDMETHODCALLTYPE *");
       write_name(header, def);
       fprintf(header, ")(\n");
@@ -775,7 +775,7 @@ static void write_method_proto(const type_t *iface)
 
     if (!is_local(def->attrs)) {
       /* proxy prototype */
-      write_type_decl_left(header, def->type);
+      write_type_decl_left(header, get_func_return_type(cur));
       fprintf(header, " CALLBACK %s_", iface->name);
       write_name(header, def);
       fprintf(header, "_Proxy(\n");
@@ -815,14 +815,14 @@ void write_locals(FILE *fp, const type_t *iface, int body)
       if (&m->entry != iface->funcs) {
         const var_t *mdef = m->def;
         /* proxy prototype - use local prototype */
-        write_type_decl_left(fp, mdef->type);
+        write_type_decl_left(fp, get_func_return_type(m));
         fprintf(fp, " CALLBACK %s_", iface->name);
         write_name(fp, mdef);
         fprintf(fp, "_Proxy(\n");
         write_args(fp, m->args, iface->name, 1, TRUE);
         fprintf(fp, ")");
         if (body) {
-          type_t *rt = mdef->type;
+          type_t *rt = get_func_return_type(m);
           fprintf(fp, "\n{\n");
           fprintf(fp, "    %s\n", comment);
           if (rt->name && strcmp(rt->name, "HRESULT") == 0)
@@ -839,7 +839,7 @@ void write_locals(FILE *fp, const type_t *iface, int body)
         else
           fprintf(fp, ";\n");
         /* stub prototype - use remotable prototype */
-        write_type_decl_left(fp, def->type);
+        write_type_decl_left(fp, get_func_return_type(cur));
         fprintf(fp, " __RPC_STUB %s_", iface->name);
         write_name(fp, mdef);
         fprintf(fp, "_Stub(\n");
@@ -862,7 +862,7 @@ static void write_function_proto(const type_t *iface, const func_t *fun, const c
   var_t *def = fun->def;
 
   /* FIXME: do we need to handle call_as? */
-  write_type_decl_left(header, def->type);
+  write_type_decl_left(header, get_func_return_type(fun));
   fprintf(header, " ");
   write_prefix_name(header, prefix, def);
   fprintf(header, "(\n");
diff --git a/tools/widl/proxy.c b/tools/widl/proxy.c
index 039f54eaa1e..a9710b2711a 100644
--- a/tools/widl/proxy.c
+++ b/tools/widl/proxy.c
@@ -251,11 +251,11 @@ static void gen_proxy(type_t *iface, const func_t *cur, int idx,
                       unsigned int proc_offset)
 {
   var_t *def = cur->def;
-  int has_ret = !is_void(def->type);
+  int has_ret = !is_void(get_func_return_type(cur));
   int has_full_pointer = is_full_pointer_function(cur);
 
   indent = 0;
-  write_type_decl_left(proxy, def->type);
+  write_type_decl_left(proxy, get_func_return_type(cur));
   print_proxy( " STDMETHODCALLTYPE %s_", iface->name);
   write_name(proxy, def);
   print_proxy( "_Proxy(\n");
@@ -266,13 +266,13 @@ static void gen_proxy(type_t *iface, const func_t *cur, int idx,
   /* local variables */
   if (has_ret) {
     print_proxy( "" );
-    write_type_decl_left(proxy, def->type);
+    write_type_decl_left(proxy, get_func_return_type(cur));
     print_proxy( " _RetVal;\n");
   }
   print_proxy( "RPC_MESSAGE _RpcMessage;\n" );
   print_proxy( "MIDL_STUB_MESSAGE _StubMsg;\n" );
   if (has_ret) {
-    if (decl_indirect(def->type))
+    if (decl_indirect(get_func_return_type(cur)))
       print_proxy("void *_p_%s = &%s;\n",
                  "_RetVal", "_RetVal");
   }
@@ -315,9 +315,9 @@ static void gen_proxy(type_t *iface, const func_t *cur, int idx,
 
   if (has_ret)
   {
-      if (decl_indirect(def->type))
+      if (decl_indirect(get_func_return_type(cur)))
           print_proxy("MIDL_memset(&%s, 0, sizeof(%s));\n", "_RetVal", "_RetVal");
-      else if (is_ptr(def->type) || is_array(def->type))
+      else if (is_ptr(get_func_return_type(cur)) || is_array(get_func_return_type(cur)))
           print_proxy("%s = 0;\n", "_RetVal");
       write_remoting_arguments(proxy, indent, cur, PASS_RETURN, PHASE_UNMARSHAL);
   }
@@ -359,7 +359,7 @@ static void gen_stub(type_t *iface, const func_t *cur, const char *cas,
 {
   var_t *def = cur->def;
   const var_t *arg;
-  int has_ret = !is_void(def->type);
+  int has_ret = !is_void(get_func_return_type(cur));
   int has_full_pointer = is_full_pointer_function(cur);
 
   indent = 0;
@@ -431,13 +431,17 @@ static void gen_stub(type_t *iface, const func_t *cur, const char *cas,
 
   write_remoting_arguments(proxy, indent, cur, PASS_OUT, PHASE_BUFFERSIZE);
 
+  if (!is_void(get_func_return_type(cur)))
+    write_remoting_arguments(proxy, indent, cur, PASS_RETURN, PHASE_BUFFERSIZE);
+
   print_proxy("NdrStubGetBuffer(This, _pRpcChannelBuffer, &_StubMsg);\n");
 
   write_remoting_arguments(proxy, indent, cur, PASS_OUT, PHASE_MARSHAL);
   fprintf(proxy, "\n");
 
-  if (has_ret)
-      print_phase_basetype(proxy, indent, PHASE_MARSHAL, PASS_RETURN, def, "_RetVal");
+  /* marshall the return value */
+  if (!is_void(get_func_return_type(cur)))
+    write_remoting_arguments(proxy, indent, cur, PASS_RETURN, PHASE_MARSHAL);
 
   indent--;
   print_proxy("}\n");
diff --git a/tools/widl/server.c b/tools/widl/server.c
index a81c602baeb..2efb712b257 100644
--- a/tools/widl/server.c
+++ b/tools/widl/server.c
@@ -164,7 +164,7 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
         assign_stub_out_args(server, indent, func);
 
         /* Call the real server function */
-        if (!is_void(def->type))
+        if (!is_void(get_func_return_type(func)))
             print_server("_RetVal = ");
         else
             print_server("");
@@ -212,7 +212,7 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
         {
             write_remoting_arguments(server, indent, func, PASS_OUT, PHASE_BUFFERSIZE);
 
-            if (!is_void(def->type))
+            if (!is_void(get_func_return_type(func)))
                 write_remoting_arguments(server, indent, func, PASS_RETURN, PHASE_BUFFERSIZE);
 
             print_server("_pRpcMessage->BufferLength = _StubMsg.BufferLength;\n");
@@ -231,7 +231,7 @@ static void write_function_stubs(type_t *iface, unsigned int *proc_offset)
         write_remoting_arguments(server, indent, func, PASS_OUT, PHASE_MARSHAL);
 
         /* marshall the return value */
-        if (!is_void(def->type))
+        if (!is_void(get_func_return_type(func)))
             write_remoting_arguments(server, indent, func, PASS_RETURN, PHASE_MARSHAL);
 
         indent--;
diff --git a/tools/widl/typegen.c b/tools/widl/typegen.c
index 2b0a624daeb..203258d3d29 100644
--- a/tools/widl/typegen.c
+++ b/tools/widl/typegen.c
@@ -418,8 +418,8 @@ void write_parameters_init(FILE *file, int indent, const func_t *func)
 {
     const var_t *var;
 
-    if (!is_void(func->def->type))
-        write_var_init(file, indent, func->def->type, "_RetVal");
+    if (!is_void(get_func_return_type(func)))
+        write_var_init(file, indent, get_func_return_type(func), "_RetVal");
 
     if (!func->args)
         return;
@@ -493,14 +493,16 @@ int decl_indirect(const type_t *t)
             && !is_array(t));
 }
 
-static size_t write_procformatstring_var(FILE *file, int indent,
-                                         const var_t *var, int is_return)
+static size_t write_procformatstring_type(FILE *file, int indent,
+                                          const char *name,
+                                          const type_t *type,
+                                          const attr_list_t *attrs,
+                                          int is_return)
 {
     size_t size;
-    const type_t *type = var->type;
 
-    int is_in = is_attr(var->attrs, ATTR_IN);
-    int is_out = is_attr(var->attrs, ATTR_OUT);
+    int is_in = is_attr(attrs, ATTR_IN);
+    int is_out = is_attr(attrs, ATTR_OUT);
 
     if (!is_in && !is_out) is_in = TRUE;
 
@@ -523,7 +525,7 @@ static size_t write_procformatstring_var(FILE *file, int indent,
         }
         else
         {
-            error("Unknown/unsupported type: %s (0x%02x)\n", var->name, type->type);
+            error("Unknown/unsupported type: %s (0x%02x)\n", name, type->type);
             size = 0;
         }
     }
@@ -573,18 +575,17 @@ void write_procformatstring(FILE *file, const ifref_list_t *ifaces, type_pred_t
                 if (func->args)
                 {
                     LIST_FOR_EACH_ENTRY( var, func->args, const var_t, entry )
-                        write_procformatstring_var(file, indent, var, FALSE);
+                        write_procformatstring_type(file, indent, var->name, var->type, var->attrs, FALSE);
                 }
 
                 /* emit return value data */
-                var = func->def;
-                if (is_void(var->type))
+                if (is_void(get_func_return_type(func)))
                 {
                     print_file(file, indent, "0x5b,    /* FC_END */\n");
                     print_file(file, indent, "0x5c,    /* FC_PAD */\n");
                 }
                 else
-                    write_procformatstring_var(file, indent, var, TRUE);
+                    write_procformatstring_type(file, indent, "return value", get_func_return_type(func), NULL, TRUE);
             }
         }
     }
@@ -948,7 +949,7 @@ size_t type_memsize(const type_t *t, unsigned int *align)
 int is_full_pointer_function(const func_t *func)
 {
     const var_t *var;
-    if (type_has_full_pointer(func->def->type))
+    if (type_has_full_pointer(get_func_return_type(func)))
         return TRUE;
     if (!func->args)
         return FALSE;
@@ -2356,12 +2357,16 @@ static size_t process_tfs(FILE *file, const ifref_list_t *ifaces, type_pred_t pr
             {
                 if (is_local(func->def->attrs)) continue;
 
-                if (!is_void(func->def->type))
-                    update_tfsoff(func->def->type,
+                if (!is_void(get_func_return_type(func)))
+                {
+                    var_t v = *func->def;
+                    v.type = get_func_return_type(func);
+                    update_tfsoff(get_func_return_type(func),
                                   write_typeformatstring_var(
-                                      file, 2, NULL, func->def->type,
-                                      func->def, &typeformat_offset),
+                                      file, 2, NULL, get_func_return_type(func),
+                                      &v, &typeformat_offset),
                                   file);
+                }
 
                 current_func = func;
                 if (func->args)
@@ -2568,9 +2573,11 @@ static unsigned int get_function_buffer_size( const func_t *func, enum pass pass
         }
     }
 
-    if (pass == PASS_OUT && !is_void(func->def->type))
+    if (pass == PASS_OUT && !is_void(get_func_return_type(func)))
     {
-        total_size += get_required_buffer_size(func->def, &alignment, PASS_RETURN);
+        var_t v = *func->def;
+        v.type = get_func_return_type(func);
+        total_size += get_required_buffer_size(&v, &alignment, PASS_RETURN);
         total_size += alignment;
     }
     return total_size;
@@ -3013,6 +3020,7 @@ void write_remoting_arguments(FILE *file, int indent, const func_t *func,
     {
         var_t var;
         var = *func->def;
+        var.type = get_func_return_type(func);
         var.name = xstrdup( "_RetVal" );
         write_remoting_arg( file, indent, func, pass, phase, &var );
         free( var.name );
@@ -3028,9 +3036,9 @@ void write_remoting_arguments(FILE *file, int indent, const func_t *func,
 }
 
 
-size_t get_size_procformatstring_var(const var_t *var)
+size_t get_size_procformatstring_type(const char *name, const type_t *type, const attr_list_t *attrs)
 {
-    return write_procformatstring_var(NULL, 0, var, FALSE);
+    return write_procformatstring_type(NULL, 0, name, type, attrs, FALSE);
 }
 
 
@@ -3042,13 +3050,13 @@ size_t get_size_procformatstring_func(const func_t *func)
     /* argument list size */
     if (func->args)
         LIST_FOR_EACH_ENTRY( var, func->args, const var_t, entry )
-            size += get_size_procformatstring_var(var);
+            size += get_size_procformatstring_type(var->name, var->type, var->attrs);
 
     /* return value size */
-    if (is_void(func->def->type))
+    if (is_void(get_func_return_type(func)))
         size += 2; /* FC_END and FC_PAD */
     else
-        size += get_size_procformatstring_var(func->def);
+        size += get_size_procformatstring_type("return value", get_func_return_type(func), NULL);
 
     return size;
 }
@@ -3180,14 +3188,13 @@ void declare_stub_args( FILE *file, int indent, const func_t *func )
 {
     int in_attr, out_attr;
     int i = 0;
-    const var_t *def = func->def;
     const var_t *var;
 
     /* declare return value '_RetVal' */
-    if (!is_void(def->type))
+    if (!is_void(get_func_return_type(func)))
     {
         print_file(file, indent, "");
-        write_type_decl_left(file, def->type);
+        write_type_decl_left(file, get_func_return_type(func));
         fprintf(file, " _RetVal;\n");
     }
 
diff --git a/tools/widl/typegen.h b/tools/widl/typegen.h
index 4408ffa75ec..7745454442e 100644
--- a/tools/widl/typegen.h
+++ b/tools/widl/typegen.h
@@ -43,7 +43,7 @@ void write_procformatstring(FILE *file, const ifref_list_t *ifaces, type_pred_t
 void write_typeformatstring(FILE *file, const ifref_list_t *ifaces, type_pred_t pred);
 void print_phase_basetype(FILE *file, int indent, enum remoting_phase phase, enum pass pass, const var_t *var, const char *varname);
 void write_remoting_arguments(FILE *file, int indent, const func_t *func, enum pass pass, enum remoting_phase phase);
-size_t get_size_procformatstring_var(const var_t *var);
+size_t get_size_procformatstring_type(const char *name, const type_t *type, const attr_list_t *attrs);
 size_t get_size_procformatstring_func(const func_t *func);
 size_t get_size_procformatstring(const ifref_list_t *ifaces, type_pred_t pred);
 size_t get_size_typeformatstring(const ifref_list_t *ifaces, type_pred_t pred);
diff --git a/tools/widl/widltypes.h b/tools/widl/widltypes.h
index 7ddb449f508..ec6b05f24f5 100644
--- a/tools/widl/widltypes.h
+++ b/tools/widl/widltypes.h
@@ -330,4 +330,9 @@ int cant_be_null(const var_t *v);
 int is_struct(unsigned char tc);
 int is_union(unsigned char tc);
 
+static inline type_t *get_func_return_type(const func_t *func)
+{
+  return func->def->type;
+}
+
 #endif
diff --git a/tools/widl/write_msft.c b/tools/widl/write_msft.c
index cba92de5ebe..1b354bbbf91 100644
--- a/tools/widl/write_msft.c
+++ b/tools/widl/write_msft.c
@@ -1421,7 +1421,7 @@ static HRESULT add_func_desc(msft_typeinfo_t* typeinfo, const func_t *func, int
 
     /* fill out the basic type information */
     typedata[0] = typedata_size | (index << 16);
-    encode_var(typeinfo->typelib, func->def->type, func->def, &typedata[1], NULL, NULL, &decoded_size);
+    encode_var(typeinfo->typelib, get_func_return_type(func), func->def, &typedata[1], NULL, NULL, &decoded_size);
     typedata[2] = funcflags;
     typedata[3] = ((52 /*sizeof(FUNCDESC)*/ + decoded_size) << 16) | typeinfo->typeinfo->cbSizeVft;
     typedata[4] = (next_idx << 16) | (callconv << 8) | (invokekind << 3) | funckind;