diff --git a/ChangeLog b/ChangeLog
index fe460ec33..37c4a6679 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,13 @@
 	* Version 1.5.2
 	* Documentation: Update.
 
+	* Source/cifframe.m (cifframe_from_info): Include retval in
+	cifframe_t struct not as pass-back argument.
+	* Source/GSFFIInvocation.m (-initWithMethodSignature:): Get retval
+	from cifframe.
+	(-initWithCallback:...): Idem.
+	(GSFFIInvocationCallback): Set return pointer in closure.
+
 2003-02-16  Richard Frith-Macdonald <rfm@gnu.org>
 
 	* Source/GSDictionary.m: ([-isEqualToDictionary:]) implement optimised
diff --git a/Source/GSFFIInvocation.m b/Source/GSFFIInvocation.m
index 660495d3a..16bdae341 100644
--- a/Source/GSFFIInvocation.m
+++ b/Source/GSFFIInvocation.m
@@ -169,7 +169,7 @@ static IMP gs_objc_msg_forward (SEL sel)
   /* Note: We malloc cframe here, but it's passed to GSFFIInvocationCallback
      where it becomes owned by the callback invocation, so we don't have to
      worry about freeing it */
-  cframe = cifframe_from_info([sig methodInfo], [sig numberOfArguments], NULL);
+  cframe = cifframe_from_info([sig methodInfo], [sig numberOfArguments]);
   /* Autorelease the closure through fastMallocBuffer */
   cclosure = (ffi_closure *)_fastMallocBuffer(sizeof(ffi_closure));
   if (cframe == NULL || cclosure == NULL)
@@ -212,7 +212,8 @@ static IMP gs_objc_msg_forward (SEL sel)
   _sig = RETAIN(aSignature);
   _numArgs = [aSignature numberOfArguments];
   _info = [aSignature methodInfo];
-  _cframe = cifframe_from_info(_info, _numArgs, &_retval);
+  _cframe = cifframe_from_info(_info, _numArgs);
+  _retval = ((cifframe_t *)_cframe)->retval;
   return self;
 }
 
@@ -220,7 +221,6 @@ static IMP gs_objc_msg_forward (SEL sel)
    the callback. The cifframe was allocated by the forwarding function,
    but we own it now so we can free it */
 - (id) initWithCallback: (ffi_cif *)cif 
-		returnp: (void *)retp
 		 values: (void **)vals
 		  frame: (cifframe_t *)frame
 	      signature: (NSMethodSignature*)aSignature
@@ -253,7 +253,7 @@ static IMP gs_objc_msg_forward (SEL sel)
 #else
   ((cifframe_t *)_cframe)->values = vals;
 #endif
-  _retval = retp;
+  _retval = ((cifframe_t *)_cframe)->retval;
   return self;
 }
 
@@ -389,7 +389,6 @@ GSFFIInvocationCallback(ffi_cif *cif, void *retp, void **args, void *user)
     NSStringFromSelector(selector));
     
   invocation = [[GSFFIInvocation alloc] initWithCallback: cif
-					returnp: retp
 					values: args
  					frame: user
 					signature: sig];
@@ -408,6 +407,7 @@ GSFFIInvocationCallback(ffi_cif *cif, void *retp, void **args, void *user)
   fwdInvMethod->method_imp (obj, fwdInvMethod->method_name, invocation);
 
   /* We need to (re)encode the return type for it's trip back. */
+  retp = [invocation returnFrame: NULL];
   if (retp)
     cifframe_encode_arg([sig methodReturnType], retp);
 }
diff --git a/Source/cifframe.h b/Source/cifframe.h
index e56baf0af..1148d7283 100644
--- a/Source/cifframe.h
+++ b/Source/cifframe.h
@@ -34,10 +34,10 @@ typedef struct _cifframe_t {
   int nargs;
   ffi_type **arg_types;
   void **values;
+  void *retval;
 } cifframe_t;
 
-extern cifframe_t *cifframe_from_info (NSArgumentInfo *info, int numargs,
-					 void **retval);
+extern cifframe_t *cifframe_from_info (NSArgumentInfo *info, int numargs);
 extern void cifframe_set_arg(cifframe_t *cframe, int index, void *buffer, 
 			     int size);
 extern void cifframe_get_arg(cifframe_t *cframe, int index, void *buffer,
diff --git a/Source/cifframe.m b/Source/cifframe.m
index 5a8934d08..81f8bcde4 100644
--- a/Source/cifframe.m
+++ b/Source/cifframe.m
@@ -116,7 +116,7 @@ cifframe_guess_struct_size(ffi_type *stype)
      
 
 cifframe_t *
-cifframe_from_info (NSArgumentInfo *info, int numargs, void **retval)
+cifframe_from_info (NSArgumentInfo *info, int numargs)
 {
   unsigned      size = sizeof(cifframe_t);
   unsigned      align = __alignof(double);
@@ -191,9 +191,9 @@ cifframe_from_info (NSArgumentInfo *info, int numargs, void **retval)
       else
 	full += MAX(rtype->size, sizeof(smallret_t));
       cframe = buf = NSZoneCalloc(NSDefaultMallocZone(), full, 1);
-      if (cframe && retval)
+      if (cframe)
 	{
-	  *retval = buf + pos;
+	  cframe->retval = buf + pos;
 	}
     }
   else
@@ -700,8 +700,8 @@ cifframe_do_call (DOContext *ctxt,
 
   /* Build the cif frame */
   sig = [NSMethodSignature signatureWithObjCTypes: type];
-  cframe = cifframe_from_info([sig methodInfo], [sig numberOfArguments], 
-			       &retval);
+  cframe = cifframe_from_info([sig methodInfo], [sig numberOfArguments]);
+  retval = cframe->retval;
   ctxt->datToFree = cframe;
 
   /* Put OBJECT and SELECTOR into the ARGFRAME. */
@@ -986,8 +986,8 @@ cifframe_build_return (NSInvocation *inv,
 
   /* Build the cif frame */
   sig = [NSMethodSignature signatureWithObjCTypes: type];
-  cframe = cifframe_from_info([sig methodInfo], [sig numberOfArguments], 
-			       &retval);
+  cframe = cifframe_from_info([sig methodInfo], [sig numberOfArguments]);
+  retval = cframe->retval;
   ctxt->datToFree = cframe;
 
   /* Get the return type qualifier flags, and the return type. */