pointers: scope define variables to their in

packages/pointers/CHANGELOG.md

@@ -6,6 +6,14 @@ itself are tracked in the root [`CHANGELOG.md`](../../CHANGELOG.md).
 
 ## Unreleased
 
+### Fixed
+
+- `dereference` scopes the variables of a `define` to its `in`. They used to
+  stay defined after the `in` finished, so a `define` inside one member of a
+  `group` changed the variables seen by the later members. This is how solc's
+  template for a struct with a string member read the members after it one slot
+  too far ([#317]).
+
 ## 0.1.0-preview.1 — 2026-10-03
 
 ### Fixed
@@ -112,3 +120,4 @@ First publication.
 [`59a5c38`]: https://github.com/ethdebug/format/commit/59a5c38
 [#315]: https://github.com/ethdebug/format/pull/315
 [#316]: https://github.com/ethdebug/format/pull/316
+[#317]: https://github.com/ethdebug/format/pull/317

packages/pointers/src/dereference/generate.ts

@@ -89,6 +89,13 @@ export async function* generateRegions(
         Object.assign(variables, memo.variables);
         break;
       }
+      case "restore-variables": {
+        for (const name of Object.keys(variables)) {
+          delete variables[name];
+        }
+        Object.assign(variables, memo.variables);
+        break;
+      }
       case "push-region-renames": {
         renameStack.push(memo.mapping);
         break;

packages/pointers/src/dereference/index.test.ts

@@ -306,6 +306,67 @@ describe("dereference", () => {
     expect(regions[0].length).toEqual(Data.fromNumber(32));
   });
 
+  it("scopes defined variables to their `in`", async () => {
+    const pointer: Pointer = {
+      define: { slot: "0x00" },
+      in: {
+        group: [
+          {
+            define: { slot: { $sum: ["slot", 1] } },
+            in: { location: "storage", slot: "slot", name: "a" },
+          },
+          {
+            location: "storage",
+            slot: { $sum: ["slot", 2] },
+            name: "b",
+          },
+        ],
+      },
+    };
+
+    const cursor = await dereference(pointer);
+
+    const { regions } = await cursor.view(state);
+
+    expect(regions.map(({ name }) => name)).toEqual(["a", "b"]);
+    expect(regions[0]).toMatchObject({ slot: Data.fromNumber(1) });
+    expect(regions[1]).toMatchObject({ slot: Data.fromNumber(2) });
+  });
+
+  it("scopes variables defined inside referenced templates", async () => {
+    const pointer: Pointer = {
+      define: { slot: "0x00" },
+      in: {
+        templates: {
+          shifted: {
+            expect: ["slot"],
+            for: {
+              define: { slot: { $sum: ["slot", 1] } },
+              in: { location: "storage", slot: "slot", name: "a" },
+            },
+          },
+        },
+        in: {
+          group: [
+            { template: "shifted" },
+            {
+              location: "storage",
+              slot: { $sum: ["slot", 2] },
+              name: "b",
+            },
+          ],
+        },
+      },
+    };
+
+    const cursor = await dereference(pointer);
+
+    const { regions } = await cursor.view(state);
+
+    expect(regions[0]).toMatchObject({ slot: Data.fromNumber(1) });
+    expect(regions[1]).toMatchObject({ slot: Data.fromNumber(2) });
+  });
+
   it("works for templates", async () => {
     const templates: Pointer.Templates = {
       "memory-range": {

packages/pointers/src/dereference/memo.ts

@@ -9,6 +9,7 @@ export type Memo =
   | Memo.DereferencePointer
   | Memo.SaveRegions
   | Memo.SaveVariables
+  | Memo.RestoreVariables
   | Memo.PushRegionRenames
   | Memo.PopRegionRenames
   | Memo.PushTemplates
@@ -75,6 +76,25 @@ export namespace Memo {
     variables,
   });
 
+  /**
+   * A request to replace the stateful map of variable values with a
+   * snapshot taken earlier, discarding every variable saved since.
+   */
+  export interface RestoreVariables {
+    kind: "restore-variables";
+    variables: Record<string, Value>;
+  }
+
+  /**
+   * Initialize a RestoreVariables memo
+   */
+  export const restoreVariables = (
+    variables: Record<string, Value>,
+  ): RestoreVariables => ({
+    kind: "restore-variables",
+    variables,
+  });
+
   /**
    * A request to push a region rename mapping onto the context stack.
    * While active, regions with names in the mapping will be saved under

packages/pointers/src/dereference/process.ts

@@ -153,7 +153,14 @@ async function* processScope(
     newVariables[identifier] = value;
   }
 
-  return [Memo.saveVariables(newVariables), Memo.dereferencePointer(in_)];
+  // variables defined here are visible only within `in`
+  return [
+    Memo.saveVariables(newVariables),
+    Memo.dereferencePointer(in_),
+    Memo.restoreVariables(
+      Object.assign(Object.create(null), options.variables),
+    ),
+  ];
 }
 
 async function* processReference(