Index: ext/misc/json1.c
==================================================================
--- ext/misc/json1.c
+++ ext/misc/json1.c
@@ -193,18 +193,10 @@
   sqlite3_vsnprintf(N, p->zBuf+p->nUsed, zFormat, ap);
   va_end(ap);
   p->nUsed += (int)strlen(p->zBuf+p->nUsed);
 }
 
-#ifdef SQLITE_DEBUG
-/* Append the zero-terminated string zIn
-*/
-static void jsonAppend(JsonString *p, const char *zIn){
-  jsonAppendRaw(p, zIn, (u32)strlen(zIn));
-}
-#endif
-
 /* Append a single character
 */
 static void jsonAppendChar(JsonString *p, char c){
   if( p->nUsed>=p->nAlloc && jsonGrow(p,1)!=0 ) return;
   p->zBuf[p->nUsed++] = c;
@@ -466,18 +458,16 @@
             zOut[j++] = c;
           }else{
             c = z[++i];
             if( c=='u' && z[1] ){
               u32 v = 0, k;
-              z++;
-              for(k=0; k<4 && z[k]; k++){
-                c = z[0];
+              for(k=0; k<4 && z[i+1]; i++, k++){
+                c = z[i+1];
                 if( c>='0' && c<='9' ) v = v*16 + c - '0';
                 else if( c>='A' && c<='F' ) v = v*16 + c - 'A' + 10;
                 else if( c>='a' && c<='f' ) v = v*16 + c - 'a' + 10;
                 else break;
-                z++;
               }
               if( v<=0x7f ){
                 zOut[j++] = v;
               }else if( v<=0x7ff ){
                 zOut[j++] = 0xc0 | (v>>6);
@@ -676,11 +666,15 @@
       if( c=='e' || c=='E' ){
         if( pParse->zJson[j-1]<'0' ) return -1;
         if( seenE ) return -1;
         seenDP = seenE = 1;
         c = pParse->zJson[j+1];
-        if( c=='+' || c=='-' ) j++;
+        if( c=='+' || c=='-' ){
+          j++;
+          c = pParse->zJson[j+1];
+        }
+        if( c<'0' || c>'0' ) return -1;
         continue;
       }
       break;
     }
     if( pParse->zJson[j-1]<'0' ) return -1;
@@ -835,11 +829,11 @@
   }else if( zPath[0]=='[' && isdigit(zPath[1]) ){
     if( pRoot->eType!=JSON_ARRAY ) return 0;
     i = 0;
     zPath++;
     while( isdigit(zPath[0]) ){
-      i = i + zPath[0] - '0';
+      i = i*10 + zPath[0] - '0';
       zPath++;
     }
     if( zPath[0]!=']' ) return 0;
     zPath++;
     j = 1;
@@ -928,19 +922,18 @@
   sqlite3_value **argv
 ){
   JsonString s;       /* Output string - not real JSON */
   JsonParse x;        /* The parse */
   u32 i;
-  char zBuf[100];
 
   assert( argc==1 );
   if( jsonParse(&x, ctx, (const char*)sqlite3_value_text(argv[0])) ) return;
+  jsonParseFindParents(&x);
   jsonInit(&s, ctx);
   for(i=0; i<x.nNode; i++){
-    sqlite3_snprintf(sizeof(zBuf), zBuf, "node %3u: %7s n=%d\n",
-                     i, jsonType[x.aNode[i].eType], x.aNode[i].n);
-    jsonAppend(&s, zBuf);
+    jsonPrintf(100, &s,"node %3u: %7s n=%-4d up=%d\n",
+               i, jsonType[x.aNode[i].eType], x.aNode[i].n, x.aUp[i]);
     if( x.aNode[i].u.zJContent!=0 ){
       jsonAppendRaw(&s, "    text: ", 10);
       jsonAppendRaw(&s, x.aNode[i].u.zJContent, x.aNode[i].n);
       jsonAppendRaw(&s, "\n", 1);
     }
@@ -1416,22 +1409,27 @@
 static int jsonEachNext(sqlite3_vtab_cursor *cur){
   JsonEachCursor *p = (JsonEachCursor*)cur;
   if( p->bRecursive ){
     if( p->i==0 ){
       p->i = 1;
-    }else if( p->sParse.aNode[p->sParse.aUp[p->i]].eType==JSON_OBJECT ){
-      p->i += 2;
     }else{
+      u32 iUp = p->sParse.aUp[p->i];
+      JsonNode *pUp = &p->sParse.aNode[iUp];
       p->i++;
+      if( pUp->eType==JSON_OBJECT && (pUp->n + iUp >= p->i) ) p->i++;
     }
     p->iRowid++;
     if( p->i<p->sParse.nNode ){
-      JsonNode *pUp = &p->sParse.aNode[p->sParse.aUp[p->i]];
+      u32 iUp = p->sParse.aUp[p->i];
+      JsonNode *pUp = &p->sParse.aNode[iUp];
       p->eType = pUp->eType;
-      if( pUp->eType==JSON_ARRAY ) pUp->u.iKey++;
-      if( p->sParse.aNode[p->i].eType==JSON_ARRAY ){
-        p->sParse.aNode[p->i].u.iKey = 0;
+      if( pUp->eType==JSON_ARRAY ){
+        if( iUp==p->i-1 ){
+          pUp->u.iKey = 0;
+        }else{
+          pUp->u.iKey++;
+        }
       }
     }
   }else{
     switch( p->eType ){
       case JSON_ARRAY: {
@@ -1488,26 +1486,27 @@
 ){
   JsonEachCursor *p = (JsonEachCursor*)cur;
   JsonNode *pThis = &p->sParse.aNode[p->i];
   switch( i ){
     case JEACH_KEY: {
+      if( p->i==0 ) break;
       if( p->eType==JSON_OBJECT ){
         jsonReturn(pThis, ctx, 0);
       }else if( p->eType==JSON_ARRAY ){
         u32 iKey;
         if( p->bRecursive ){
           if( p->iRowid==0 ) break;
-          iKey = p->sParse.aNode[p->sParse.aUp[p->i]].u.iKey - 1;
+          iKey = p->sParse.aNode[p->sParse.aUp[p->i]].u.iKey;
         }else{
           iKey = p->iRowid;
         }
         sqlite3_result_int64(ctx, (sqlite3_int64)iKey);
       }
       break;
     }
     case JEACH_VALUE: {
-      if( p->eType==JSON_OBJECT ) pThis++;
+      if( p->eType==JSON_OBJECT && p->i>0 ) pThis++;
       jsonReturn(pThis, ctx, 0);
       break;
     }
     case JEACH_TYPE: {
       if( p->eType==JSON_OBJECT ) pThis++;
@@ -1670,11 +1669,12 @@
       pNode = p->sParse.aNode;
     }
     p->i = (int)(pNode - p->sParse.aNode);
     p->eType = pNode->eType;
     if( p->eType>=JSON_ARRAY ){
-      p->i++;
+      pNode->u.iKey = 0;
+      if( !p->bRecursive ) p->i++;
       p->iEnd = p->i + pNode->n;
     }else{
       p->iEnd = p->i+1;
     }
   }