Fix adoption agency algorithm according to the latest specification

This implements the specification change:
whatwg/html@22ce3c31

Current implementation should pass all new html5lib test cases, including
those from Blink, WebKit, and namespace sensitivity.

See related:
html5lib/html5lib-tests#78
https://bugzilla.mozilla.org/show_bug.cgi?id=901319
https://lists.w3.org/Archives/Public/public-html/2013Aug/0002.html
https://lists.w3.org/Archives/Public/public-whatwg-archive/2013Jul/0401.html
https://lists.w3.org/Archives/Public/public-whatwg-archive/2013Jul/0006.html

Author: iabudiab

HTMLKit/HTMLParser.m

@@ -588,18 +588,27 @@ - (BOOL)runAdoptionAgencyAlgorithmForTagName:(NSString *)tagName
 		HTMLElement *lastNode = furthestBlock;
 
 		NSUInteger index = [_stackOfOpenElements indexOfElement:node];
-		for (int innerLoopCounter = 0; innerLoopCounter < 3; innerLoopCounter ++) {
 
-			index--;
+		int innerLoopCounter = 0;
+		while (YES) {
+
+			innerLoopCounter += 1;
+			index -= 1;
+
 			node = _stackOfOpenElements[index];
 
-			if (![_listOfActiveFormattingElements containsElement:node]) {
-				[_stackOfOpenElements removeElement:node];
+			if ([node isEqual:formattingElement]) {
+				break;
+			}
+
+			if (innerLoopCounter > 3 && [_listOfActiveFormattingElements containsElement:node]) {
+				[_listOfActiveFormattingElements removeElement:node];
 				continue;
 			}
 
-			if ([node isEqual:formattingElement]) {
-				break;
+			if (![_listOfActiveFormattingElements containsElement:node]) {
+				[_stackOfOpenElements removeElement:node];
+				continue;
 			}
 
 			HTMLElement *newElement = [node copy];