Auto merge of #5630 - Ms2ger:substringData, r=Manishearth

components/script/dom/characterdata.rs

@@ -73,7 +73,7 @@ impl<'a> CharacterDataMethods for JSRef<'a, CharacterData> {
         let data = self.data.borrow();
         // Step 1.
         let len = data.chars().count();
-        if len > offset as usize {
+        if offset as usize > len {
             // Step 2.
             return Err(IndexSize);
         }

tests/wpt/metadata/dom/nodes/CharacterData-substringData.html.ini

@@ -1,3 +0,0 @@
-[CharacterData-substringData.html]
-  type: testharness
-  expected: CRASH