:-webkit-any pseudo with escaped '(' should not crash.

Source/core/css/CSSSelector.cpp

Index: Source/core/css/CSSSelector.cpp
diff --git a/Source/core/css/CSSSelector.cpp b/Source/core/css/CSSSelector.cpp
index 38743290e899acb5bfb68603d80a36a42d475e8f..a3abc3dd3ee1e57a4c6d2c104edfa678aa5accee 100644
--- a/Source/core/css/CSSSelector.cpp
+++ b/Source/core/css/CSSSelector.cpp
@@ -103,10 +103,12 @@ inline unsigned CSSSelector::specificityForOneSelector() const
     case Contain:
     case Begin:
     case End:
-        // FIXME: PsuedoAny should base the specificity on the sub-selectors.
+        // FIXME: PseudoAny should base the specificity on the sub-selectors.
         // See http://lists.w3.org/Archives/Public/www-style/2010Sep/0530.html
-        if (pseudoType() == PseudoNot && selectorList())
+        if (pseudoType() == PseudoNot) {
+            ASSERT(selectorList());
             return selectorList()->first()->specificityForOneSelector();
+        }
         return 0x100;
     case Tag:
         return (tagQName().localName() != starAtom) ? 1 : 0;
@@ -627,8 +629,8 @@ String CSSSelector::selectorText(const String& rightSide) const
 
             switch (cs->pseudoType()) {
             case PseudoNot:
-                if (const CSSSelectorList* selectorList = cs->selectorList())
-                    str.append(selectorList->first()->selectorText());
+                ASSERT(cs->selectorList());
+                str.append(cs->selectorList()->first()->selectorText());
                 str.append(')');
                 break;
             case PseudoLang: