toysh fix: Move input search after initialing $PATH, and fix reversed test.
diff --git a/tests/sh.test b/tests/sh.test
index 9b81790..008fee1 100644
--- a/tests/sh.test
+++ b/tests/sh.test
@@ -74,7 +74,7 @@
 
 mkdir sub
 echo echo hello > sub/script
-$BROKEN testing 'simple script in $PATH' "PATH='$PWD/sub:$PATH' $SH script" \
+testing 'simple script in $PATH' "PATH='$PWD/sub:$PATH' $SH script" \
   'hello\n' '' ''
 rm -rf sub
 
diff --git a/toys/pending/sh.c b/toys/pending/sh.c
index 96368b5..9d2145c 100644
--- a/toys/pending/sh.c
+++ b/toys/pending/sh.c
@@ -2834,7 +2834,7 @@
 // Call binary, or run script via xexec("sh --")
 static void sh_exec(char **argv)
 {
-  char *pp = getvar("PATH" ? : _PATH_DEFPATH), *ss = TT.isexec ? : *argv,
+  char *pp = getvar("PATH") ? : _PATH_DEFPATH, *ss = TT.isexec ? : *argv,
     **sss = 0, **oldenv = environ, **argv2;
   int norecurse = CFG_TOYBOX_NORECURSE || !toys.stacktop || TT.isexec;
   struct string_list *sl = 0;
@@ -4181,7 +4181,7 @@
 
   if (fd==-1) {
     for (sl = find_in_path(pp, name); sl; free(llist_pop(&sl)))
-      if (-1==(fd = open(sl->str, O_RDONLY|O_CLOEXEC))) break;
+      if (-1!=(fd = open(sl->str, O_RDONLY|O_CLOEXEC))) break;
     if (sl) llist_traverse(sl, free);
   }
   if (fd != -1) {
@@ -4251,18 +4251,6 @@
   struct sh_vars *shv;
   struct utsname uu;
 
-  // Find input source
-  if (TT.sh.c) {
-    TT.ff->source = fmemopen(TT.sh.c, strlen(TT.sh.c), "r");
-    TT.ff->name = "-c";
-  } else if (TT.options&FLAG_s) TT.ff->source = stdin;
-  else if (!(TT.ff->source = fpathopen(TT.ff->name = *toys.optargs)))
-    perror_exit_raw(*toys.optargs);
-
-  // Add additional input sources (in reverse order so they pop off stack right)
-
-  // /etc/profile, ~/.bashrc...
-
   // Initialize magic and read only local variables
   for (ii = 0; ii<ARRAY_LEN(magic) && (s = magic[ii]); ii++)
     initvar(s, "")->flags = VAR_MAGIC+VAR_INT*('G'!=*s)+VAR_READONLY*('B'==*s);
@@ -4336,6 +4324,14 @@
   // setsid(), setpgid(), tcsetpgrp()...
   signify(SIGINT, 0);
 
+  // Find input source
+  if (TT.sh.c) {
+    TT.ff->source = fmemopen(TT.sh.c, strlen(TT.sh.c), "r");
+    TT.ff->name = "-c";
+  } else if (TT.options&FLAG_s) TT.ff->source = stdin;
+  else if (!(TT.ff->source = fpathopen(TT.ff->name = *toys.optargs)))
+    perror_exit_raw(*toys.optargs);
+
   // Add additional input sources (in reverse order so they pop off stack right)
 
   // /etc/profile, ~/.bashrc...