--- a/widget/ContentCache.cpp
+++ b/widget/ContentCache.cpp
@@ -478,16 +478,44 @@ bool
 ContentCacheInParent::HandleQueryContentEvent(WidgetQueryContentEvent& aEvent,
                                               nsIWidget* aWidget) const
 {
   MOZ_ASSERT(aWidget);
 
   aEvent.mSucceeded = false;
   aEvent.mReply.mFocusedWidget = aWidget;
 
+  // ContentCache doesn't store offset of its start with XP linebreaks.
+  // So, we don't support to query contents relative to composition start
+  // offset with XP linebreaks.
+  if (NS_WARN_IF(!aEvent.mUseNativeLineBreak)) {
+    return false;
+  }
+
+  if (NS_WARN_IF(!aEvent.mInput.IsValidOffset()) ||
+      NS_WARN_IF(!aEvent.mInput.IsValidEventMessage(aEvent.mMessage))) {
+    return false;
+  }
+
+  if (aEvent.mInput.mRelativeToInsertionPoint) {
+    if (aWidget->PluginHasFocus()) {
+      if (NS_WARN_IF(!aEvent.mInput.MakeOffsetAbsolute(0))) {
+        return false;
+      }
+    } else if (mIsComposing) {
+      if (NS_WARN_IF(!aEvent.mInput.MakeOffsetAbsolute(mCompositionStart))) {
+        return false;
+      }
+    } else if (NS_WARN_IF(!mSelection.IsValid()) ||
+               NS_WARN_IF(!aEvent.mInput.MakeOffsetAbsolute(
+                                           mSelection.StartOffset()))) {
+      return false;
+    }
+  }
+
   switch (aEvent.mMessage) {
     case eQuerySelectedText:
       MOZ_LOG(sContentCacheLog, LogLevel::Info,
         ("ContentCacheInParent: 0x%p HandleQueryContentEvent("
          "aEvent={ mMessage=eQuerySelectedText }, aWidget=0x%p)",
          this, aWidget));
       if (aWidget->PluginHasFocus()) {
         MOZ_LOG(sContentCacheLog, LogLevel::Info,