Wikimedia Bugzilla is closed!

Line 460 in OutputPage.php is:

    setcookie( $name, $val, $exp, '/' );

This hard-codes the path, and ignores the domain for cookies configured to as
$wgCookiePath, $wgCookieDomain in the settings. I suppose this is an oversight
(cookies set in all other places seem to use the settings).

The correct version would be:

    global $wgCookiePath, $wgCookieDomain;
    setcookie( $name, $val, $exp, $wgCookiePath, $wgCookieDomain );