#6990: clear threading.local's key only after its thread state is removed:

fixes local subclasses leaving old state around after a ref cycle GC which
could be recycled by new locals

Lib/test/test_threading_local.py

@@ -67,6 +67,44 @@ class ThreadingLocalTest(unittest.TestCase):
         for t in threads:
             t.join()
 
+    def test_derived_cycle_dealloc(self):
+        # http://bugs.python.org/issue6990
+        class Local(threading.local):
+            pass
+        locals = None
+        passed = [False]
+        e1 = threading.Event()
+        e2 = threading.Event()
+
+        def f():
+            # 1) Involve Local in a cycle
+            cycle = [Local()]
+            cycle.append(cycle)
+            cycle[0].foo = 'bar'
+
+            # 2) GC the cycle (triggers threadmodule.c::local_clear
+            # before local_dealloc)
+            del cycle
+            gc.collect()
+            e1.set()
+            e2.wait()
+
+            # 4) New Locals should be empty
+            passed[0] = all(not hasattr(local, 'foo') for local in locals)
+
+        t = threading.Thread(target=f)
+        t.start()
+        e1.wait()
+
+        # 3) New Locals should recycle the original's address. Creating
+        # them in the thread overwrites the thread state and avoids the
+        # bug
+        locals = [Local() for i in range(10)]
+        e2.set()
+        t.join()
+
+        self.assertTrue(passed[0])
+
 
 def test_main():
     suite = unittest.TestSuite()

Misc/NEWS

@@ -12,6 +12,9 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #6990: Fix threading.local subclasses leaving old state around
+  after a reference cycle GC which could be recycled by new locals.
+
 - Issue #6300: unicode.encode, unicode.decode, str.decode, and str.encode now
   take keyword arguments.
 

Modules/threadmodule.c

@@ -244,7 +244,6 @@ local_traverse(localobject *self, visitproc visit, void *arg)
 static int
 local_clear(localobject *self)
 {
-	Py_CLEAR(self->key);
 	Py_CLEAR(self->args);
 	Py_CLEAR(self->kw);
 	Py_CLEAR(self->dict);
@@ -266,6 +265,7 @@ local_dealloc(localobject *self)
 				PyDict_DelItem(tstate->dict, self->key);
 	}
 
+	Py_XDECREF(self->key);
 	local_clear(self);
 	Py_TYPE(self)->tp_free((PyObject*)self);
 }