Two Solidity codegen bugs disclosed via the EF bug bounty

Both are silent memory corruption — no revert, wrong state.

delete on a memory bytes element clears a full word. Applying delete to an element of a bytes array in memory writes 32 zero bytes starting at that offset instead of zeroing the single byte. It stomps the following 31 bytes of adjacent data. Reported by shaheenfazim. write-up

Spill-slot collision across mutual recursion. The IR pipeline's stack-limit evader spills locals to fixed memory offsets. Under mutual recursion, two functions could be assigned the same offset, so one call clobbers the other's live variable. Reported by Ng Sze Hon. write-up

If you use either pattern, check whether your deployed bytecode was compiled with an affected version before you upgrade past it.

@soliditypedia