This bug affects Symfony 2.3 and involves the HttpKernel and the EventDispatcher.

The TraceableEventDispatcher wraps registered events with its own events.
To do so it removes the original events and replaces them with the wrapped events:

        foreach ($listeners as $listener) {
            $this->dispatcher->removeListener($eventName, $listener);
            $wrapped = $this->wrapListener($eventName, $listener);
            $this->wrappedListeners[$this->id][$wrapped] = $listener;
            $this->dispatcher->addListener($eventName, $wrapped);
        }

(from Symfony\Component\HttpKernel\Debug\TraceableEventDispatcher::preDispatch)

Note the absence of the priority parameter when calling addListener() to re-add the wrapped events.

This problem leads to "Cannot set session ID after the session has started." exceptions when doing functional testing using the BrowserKit component. If multiple consecutive requests are issued from a single test case and firewalling and sessions are involved, the kernel.response event handler the firewall's ContextListener and the TestSessionListener may called in the wrong order. This leads to be the session being reopened by the ContextListener after it was saved by the TestSessionListener. The next BrowserKit request is therefore entered with an session which is already started and setting the session ID fails.

This is only one result of the bug given above. Since all event ordering is lost, the behaviour of the dev and test environments - with TraceableEventDispatcher enabled - differs from the prod environment, which should never be the case ...

I tried to create a fix for this (see #8405), but this involved changing the EventDispatcherInterface since I couldn't find any other way to get hold of an registered event listeners priority.