Index: /trunk/src/kash/eval.c
===================================================================
--- /trunk/src/kash/eval.c	(revision 2653)
+++ /trunk/src/kash/eval.c	(revision 2654)
@@ -677,5 +677,5 @@
 	int argc;
 	char **envp;
-	int varflag;
+	int numvars;
 	struct strlist *sp;
 	int mode;
@@ -706,22 +706,19 @@
 	psh->back_exitstatus = 0;
 
-	/** @todo r=bird: Why is arguments and envvars expanded in this
-	 * particular order?  It would be both faster and simpler to do the
-	 * envvars first and then continue with the arguments... */
 	arglist.lastp = &arglist.list;
-	varflag = 1;
 	/* Expand arguments, ignoring the initial 'name=value' ones */
-	for (argp = cmd->ncmd.args ; argp ; argp = argp->narg.next) {
-		char *p = argp->narg.text;
-		if (varflag && is_name(*p)) {
-			do {
-				p++;
-			} while (is_in_name(*p));
-			if (*p == '=')
-				continue;
-		}
+	for (argp = cmd->ncmd.args, numvars = 0 ; argp ; argp = argp->narg.next, numvars++) {
+	    char *p = argp->narg.text;
+	    char ch = *p;
+	    if (is_name(ch)) {
+		    do	ch = *++p;
+		    while (is_in_name(ch));
+		    if (ch == '=')
+			    continue;
+	    }
+	    break;
+	}
+	for (/*continue on argp from above. */ ; argp ; argp = argp->narg.next)
 		expandarg(psh, argp, &arglist, EXP_FULL | EXP_TILDE);
-		varflag = 0;
-	}
 	*arglist.lastp = NULL;
 
@@ -730,15 +727,6 @@
 	/* Now do the initial 'name=value' ones we skipped above */
 	varlist.lastp = &varlist.list;
-	for (argp = cmd->ncmd.args ; argp ; argp = argp->narg.next) {
-		char *p = argp->narg.text;
-		if (!is_name(*p))
-			break;
-		do
-			p++;
-		while (is_in_name(*p));
-		if (*p != '=')
-			break;
+	for (argp = cmd->ncmd.args ; numvars > 0 && argp ; argp = argp->narg.next, numvars--)
 		expandarg(psh, argp, &varlist, EXP_VARTILDE);
-	}
 	*varlist.lastp = NULL;