1610745 - screen.orientation.lock when used in fullscreen returns "SecurityError: the operation is insecure"

Status: RESOLVED DUPLICATE of bug 1744288

(Core :: DOM: Core & HTML, defect)

Description

[Édouard Mercier]

Attachment: lockScreenOrientation-bug.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36

Steps to reproduce:

I'm trying to use the screen.orientation.lock() API to force the screen to be in portrait mode, after having invoked the fullscreen API.

Here are the steps on a simple web page.

1. Define a click listener on a button.
2. Invoke the "requestFullscreen()" on a div element.
3. Invoke immediately "screen.orientation.lock('portrait')".
4. The device displays that web page, is initially in "portrait-primary" mode, and the user clicks the button.

Actual results:

The browser issues the error "SecurityError: the operation is insecure".

Note that on Android Firefox Preview, the same error occurs, plus the screen rotates in landscape mode.

Expected results:

The API should not raise an error and on Android Firefox Preview, the screen orientation should be kept in portrait mode.

I have attached a simple HTML page which enables to reproduce the issue.

Comment 1

[Victor]

I have the same issue, it would be great to find out why orientation.lock() cause a security error especially because in docs says that this should work on firefox/firefox android

Comment 2

[Anthony Bowker]

Observe that the security error is not raised if screen.orientation.lock is called after full screen mode has been fully entered.

Comment 3

[[:owlish] 🦉 PST]

This reproduces in the recent GV, could you please take a look? Thanks!

Comment 4

[Daniel Veditz [:dveditz]]

A security error does not mean this function is handled in the dom/security code. This is still device-specific functionality. If it's not in literal GeckoView github code, it's still in mozilla-central dom code that only GeckoView will care about so bumping it back over to DOM is unlikely to get it worked on.

Comment 5

[[ex-Mozilla] Agi Sferro | :agi]

If it's not in literal GeckoView github code, it's still in mozilla-central dom code that only GeckoView will care about so bumping it back over to DOM is unlikely to get it worked on.

We are happy to provide guidance and support on how to write code / debug / test on Android devices, but we don't own everything that happens on Android. We just don't have the manpower to do something like that.

What we do own is most things under the mobile folder and anything related directly to the GeckoView API.

Comment 6

[David Bolter [:davidb] (NeedInfo me for attention)]

Jens is this something you could help us with?

Comment 7

[Jens Stutte [:jstutte]]

Removing severity in order to get it triaged again. Note that until January probably nobody will be able to look at this.

Comment 8

[petr.laskevic]

(In reply to Jens Stutte [:jstutte] from comment #7)

Removing severity in order to get it triaged again. Note that until January probably nobody will be able to look at this.

I can still reproduce this in Firefox for Android 93.2.0 but the error code is slightly different: Uncaught (in promise) DOMException: The operation is insecure. when I run screen.orientation.lock("landscape"); after document.documentElement.requestFullscreen();

Comment 9

[asimental]

Testing here in Android 94.1.1 and enuring that fullscreen has completed results in only an NS_ERROR_UNEXPECTED error. Screen orientation is locking correctly in Chrome for Android.

Comment 10

[Makoto Kato [:m_kato]]

This sample may be incorrect. Gecko will throw exception when changing full screen mode isn't finished. So you should wait for full screen. So when I change this like the following, it works expected.

  document.querySelector("#button").addEventListener("click", async function ()
  {
    await document.querySelector("#container").requestFullscreen(); // <-- Use wait 
    screen.orientation.lock("portrait-primary")
...

And Fenix doesn't implement screen orientation API completely, so you can test this on GeckoView Example.

Comment 11

[Makoto Kato [:m_kato]]

dup of bug 1744288 due to same issue