Reject pseudo class inside :not()

Source/core/html/HTMLContentElement.cpp

Index: Source/core/html/HTMLContentElement.cpp
diff --git a/Source/core/html/HTMLContentElement.cpp b/Source/core/html/HTMLContentElement.cpp
index 1602680764bd74a1c2d2c8518913c90b57bad8ad..f75204f582e17f02efab4416532f89d0e339ce7c 100644
--- a/Source/core/html/HTMLContentElement.cpp
+++ b/Source/core/html/HTMLContentElement.cpp
@@ -82,7 +82,11 @@ void HTMLContentElement::parseAttribute(const QualifiedName& name, const AtomicS
 
 static inline bool includesDisallowedPseudoClass(const CSSSelector& selector)
 {
-    return selector.match() == CSSSelector::PseudoClass && selector.pseudoType() != CSSSelector::PseudoNot;
+    if (selector.pseudoType() == CSSSelector::PseudoNot) {
+        const CSSSelector* subSelector = selector.selectorList()->first();
+        return subSelector->match() == CSSSelector::PseudoClass;
+    }
+    return selector.match() == CSSSelector::PseudoClass;
 }
 
 bool HTMLContentElement::validateSelect() const