Change 266245 had a related patch set uploaded (by BryanDavis):
Fix typo in cookie key

https://gerrit.wikimedia.org/r/266245

Change 266245 merged by jenkins-bot:
Fix typo in cookie key

https://gerrit.wikimedia.org/r/266245

Typo fix is merged, but we need to do some thinking about how to actually test this code path under phpunit.

I have tried writing a test.

We use setcookie() which sets headers() and at the end of a test that is output by PHPUnit. That prevents the next test from invoking it or it will trigger the infamous 'headers already set' error.

Side note
The workaround is to use PHPUnit process isolation. That reset the internal PHP flag about headers that got emitted. PHPUnit does it by with a serialize() of the class to run which is written in a temp file and then sourced. When serializing an object having protected methods, null bytes are inserted and PHP 5.3 can't read a file having null bit (it outputs garbages to the buffer).

The easiest would be to let us inject the setcookie function to use in WebResponse. We vary based on $options['raw'] ? setrawcookie : setcookie and invoke that. If we added an option setcookieMethod, the test can then inject its own little method to keep track of headers being set with invoking headers().

The PHP bug

Given a file serializeme.php

<?php

class ClassWithProtected {
	protected $foobar;

}
print "<?php\nvar_dump(unserialize('" . serialize(new ClassWithProtected ) . "'));\n";

PHP 5.3

$ php -version
PHP 5.3.29 (cli) (built: Sep 21 2015 18:49:50) 
Copyright (c) 1997-2014 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2014 Zend Technologies

$ php serializeme.php |php
???????????????????????????????*f???????

PHP 5.5 from Mac OS X:

$ /usr/bin/php --version
PHP 5.5.30 (cli) (built: Oct 23 2015 17:21:45) 
Copyright (c) 1997-2015 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2015 Zend Technologies

$ php serializeme.php|/usr/bin/php
object(__PHP_Incomplete_Class)#1 (2) {
  ["__PHP_Incomplete_Class_Name"]=>
  string(18) "ClassWithProtected"
  ["foobar":protected]=>
  NULL
}

Teaching WebResponse to be injected a setCookie method is imho the best approach.

Change 266420 had a related patch set uploaded (by Hashar):
test for WebResponse::setCookie

https://gerrit.wikimedia.org/r/266420

https://gerrit.wikimedia.org/r/266420 has a basic test which would have caught the typo by exercising the MediaWiki core code (just have to clear the hook). See my cover message on Gerrit and implementation rational in the test file :-}

Change 266424 had a related patch set uploaded (by BryanDavis):
Fix typo in cookie key

https://gerrit.wikimedia.org/r/266424

Change 266424 merged by jenkins-bot:
Fix typo in cookie key

https://gerrit.wikimedia.org/r/266424

Change 266420 abandoned by Hashar:
test for WebResponse::setCookie

https://gerrit.wikimedia.org/r/266420