This is now in HTML and seem to be a web compat issue in bug 1588377.

smaug, do you have any opinions on this?

[0]: https://html.spec.whatwg.org/#attr-iframe-allow, https://w3c.github.io/webappsec-feature-policy/#iframe-allowfullscreen-attribute

That's very strange, bug 1572461 should have tackled this (or more likely something before it). Thomas will have a look.

I could see in the allowfullscreen="", not sure if it is well formatted and it seems we do not support that

Oh well, allowfullscreen is a boolean attribute and we should have supported that

I took a quick look on this web page's source and I found that the structure of the embedded player is
iframe A(container) -> document -> embedded iframe B (player)
A =
<iframe id="xdm_default6411_provider" style="display: block; margin: 0px; padding: 0px; border: 0px none;" scrolling="no" src="https://twitter.com/AAAAAAAAAAAAAAAA" allowfullscreen="" width="100%" height="406" frameborder="0"></iframe>
B =
<iframe data-src="https://www.youtube.com/AAAAAAAA" scrolling="no" allowtransparency="true" sandbox="allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts" src="https://www.youtube.com/embed/AAAAAAAAAAA" frameborder="0"></iframe>
Of course, that is cross-origin and fullscreen is disabled by default in B.
And we have to explicitly declare allowfullscreen in B to make B possible to request fullscreen.

Another thing I found is Chrome
A = <iframe allow="autoplay" allowfullscreen="" src="https://cards-frame.twitter.com/XXXXXXXXX" sandbox="allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts" class="r-1yadl64 r-16y2uox"></iframe>

B = <iframe data-src="https://www.youtube.com/embed/XXXXXXXXXX" frameborder="0" scrolling="no" allowtransparency="true" allow="autoplay; fullscreen" sandbox="allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-presentation" src="https://www.youtube.com/XXXXXXX">

I could see chrome got allow="autoplay; fullscreen" in B so chrome fullscreen works.
Likely, the documents we get in Firefox and Chrome are diferrents (Firefox without allow fullscreen and chrome with allow fullscreen), and I have no idea about that.
I dont think it is a compat issue here, annek what do you think?

allow="fullscreen" was implemented by bug 1595720 and per https://w3c.github.io/webappsec-feature-policy/#iframe-allowfullscreen-attribute we still need to keep support for the allowfullscreen attribute. (On further inspection there appears to be a problem when combining these features, filed bug 1608358 on that.)

We'll need to follow up with Twitter about them not serving us either attribute and can do so via bug 1588377.

Resolving this as INVALID therefore.

There's still a problem, we supported both allowfullscreen and allow="fullscreen", however, allowfullscreen is considered as a must, particularly for the case Youtube embedded :(, so it only works with allowfullscreen.

We have to set the condition is (allowfullscreen || allow="fullscreen") for all cases