--- tk8.5.8/unix/tkUnixWm.c	2009/08/01 08:08:18	1.58.2.3
+++ tk8.5.8/unix/tkUnixWm.c.new	2009/11/24 15:18:17	1.58.2.4
@@ -1462,8 +1462,7 @@
     if (wmPtr->clientMachine != NULL) {
 	ckfree((char *) wmPtr->clientMachine);
     }
-    wmPtr->clientMachine = (char *)
-	    ckalloc((unsigned) (length + 1));
+    wmPtr->clientMachine = ckalloc((unsigned) length + 1);
     strcpy(wmPtr->clientMachine, argv3);
     if (!(wmPtr->flags & WM_NEVER_MAPPED)) {
 	XTextProperty textProp;
@@ -1561,7 +1560,7 @@
 	return TCL_ERROR;
     }
     cmapList = (Window *) ckalloc((unsigned)
-	    ((windowObjc+1)*sizeof(Window)));
+	    (windowObjc+1) * sizeof(Window));
     gotToplevel = 0;
     for (i = 0; i < windowObjc; i++) {
 	Tk_Window mapWin;
@@ -2069,7 +2068,7 @@
 	}
 	wmPtr->hints.window_group = Tk_WindowId(wmPtr2->wrapperPtr);
 	wmPtr->hints.flags |= WindowGroupHint;
-	wmPtr->leaderName = ckalloc((unsigned) (length + 1));
+	wmPtr->leaderName = ckalloc((unsigned) length + 1);
 	strcpy(wmPtr->leaderName, argv3);
     }
     UpdateHints(winPtr);
@@ -2297,7 +2296,7 @@
 	    ckfree((char *) wmPtr->iconName);
 	}
 	argv3 = Tcl_GetStringFromObj(objv[3], &length);
-	wmPtr->iconName = ckalloc((unsigned) (length + 1));
+	wmPtr->iconName = ckalloc((unsigned) length + 1);
 	strcpy(wmPtr->iconName, argv3);
 	if (!(wmPtr->flags & WM_NEVER_MAPPED)) {
 	    UpdateTitle(winPtr);
@@ -2335,7 +2334,7 @@
     Tk_PhotoHandle photo;
     Tk_PhotoImageBlock block;
     int i, size = 0, width, height, index = 0, x, y, isDefault = 0;
-    unsigned int *iconPropertyData;
+    unsigned long *iconPropertyData;
 
     if (objc < 4) {
 	Tcl_WrongNumArgs(interp, 2, objv,
@@ -2375,15 +2374,17 @@
 
     /*
      * We have calculated the size of the data. Try to allocate the needed
-     * memory space.
+     * memory space. This is an unsigned long array (despite this being twice
+     * as much as is really needed on LP64 platforms) because that's what X
+     * defines CARD32 arrays to use. [Bug 2902814]
      */
 
-    iconPropertyData = (unsigned int *)
-	    Tcl_AttemptAlloc(sizeof(unsigned int) * size);
+    iconPropertyData = (unsigned long *)
+	    attemptckalloc(sizeof(unsigned long) * size);
     if (iconPropertyData == NULL) {
 	return TCL_ERROR;
     }
-    memset(iconPropertyData, 0, sizeof(unsigned int) * size);
+    memset(iconPropertyData, 0, sizeof(unsigned long) * size);
 
     for (i = 3 + isDefault; i < objc; i++) {
 	photo = Tk_FindPhoto(interp, Tcl_GetString(objv[i]));
@@ -2421,7 +2422,7 @@
 	    for (x = 0; x < width; x++) {
 		register unsigned char *pixelPtr =
 			block.pixelPtr + x*block.pixelSize + y*block.pitch;
-		register unsigned int R, G, B, A;
+		register unsigned long R, G, B, A;
 
 		R = pixelPtr[block.offset[0]];
 		G = pixelPtr[block.offset[1]];
@@ -3388,7 +3389,7 @@
 	    ckfree((char *) wmPtr->title);
 	}
 	argv3 = Tcl_GetStringFromObj(objv[3], &length);
-	wmPtr->title = ckalloc((unsigned) (length + 1));
+	wmPtr->title = ckalloc((unsigned) length + 1);
 	strcpy(wmPtr->title, argv3);
 
 	if (!(wmPtr->flags & WM_NEVER_MAPPED)) {
@@ -5982,7 +5983,7 @@
 	    protPtr = protPtr->nextPtr, count++) {
 	/* Empty loop body; we're just counting the handlers. */
     }
-    arrayPtr = (Atom *) ckalloc((unsigned) (count * sizeof(Atom)));
+    arrayPtr = (Atom *) ckalloc((unsigned) count * sizeof(Atom));
     deleteWindowAtom = Tk_InternAtom((Tk_Window) wmPtr->winPtr,
 	    "WM_DELETE_WINDOW");
     pingAtom = Tk_InternAtom((Tk_Window) wmPtr->winPtr, "_NET_WM_PING");
@@ -6378,7 +6379,7 @@
      * add the toplevel itself as the last element of the list.
      */
 
-    newPtr = (Window *) ckalloc((unsigned) ((count+2)*sizeof(Window)));
+    newPtr = (Window *) ckalloc((unsigned) (count+2) * sizeof(Window));
     for (i = 0; i < count; i++) {
 	newPtr[i] = oldPtr[i];
     }