:-webkit-any pseudo with escaped '(' should not crash.

Source/core/css/CSSSelector.cpp

 /*
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  *               2001 Andreas Schlapbach (schlpbch@iam.unibe.ch)
  *               2001-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 85 matching lines @@
     case Exact:
     case Class:
     case Set:
     case List:
     case Hyphen:
     case PseudoClass:
     case PseudoElement:
     case Contain:
     case Begin:
     case End:
-        // FIXME: PsuedoAny should base the specificity on the sub-selectors.
+        // FIXME: PseudoAny should base the specificity on the sub-selectors.
         // See http://lists.w3.org/Archives/Public/www-style/2010Sep/0530.html
-        if (pseudoType() == PseudoNot && selectorList())
+        if (pseudoType() == PseudoNot) {
+            ASSERT(selectorList());
             return selectorList()->first()->specificityForOneSelector();
+        }
         return 0x100;
     case Tag:
         return (tagQName().localName() != starAtom) ? 1 : 0;
     case Unknown:
         return 0;
     }
     ASSERT_NOT_REACHED();
     return 0;
 }
 
@@ skipping 500 matching lines @@
             serializeIdentifier(cs->value(), str);
         } else if (cs->m_match == CSSSelector::Class) {
             str.append('.');
             serializeIdentifier(cs->value(), str);
         } else if (cs->m_match == CSSSelector::PseudoClass || cs->m_match == CSSSelector::PagePseudoClass) {
             str.append(':');
             str.append(cs->value());
 
             switch (cs->pseudoType()) {
             case PseudoNot:
-                if (const CSSSelectorList* selectorList = cs->selectorList())
-                    str.append(selectorList->first()->selectorText());
+                ASSERT(cs->selectorList());
+                str.append(cs->selectorList()->first()->selectorText());
                 str.append(')');
                 break;
             case PseudoLang:
             case PseudoNthChild:
             case PseudoNthLastChild:
             case PseudoNthOfType:
             case PseudoNthLastOfType:
                 str.append(cs->argument());
                 str.append(')');
                 break;
@@ skipping 280 matching lines @@
             return false;
         return (count - m_b) % m_a == 0;
     } else {
         if (count > m_b)
             return false;
         return (m_b - count) % (-m_a) == 0;
     }
 }
 
 } // namespace WebCore