Issue in setting accessor in PathTypeHandlerWithAttr

When the property is deleted (say when we are in SimpleTypeHandler) and then later
if we create an accessor on the same property we have converted the type handler to PathTypeHandlerWithAttr.
Since a property got deleted and PathTypeHandler should not handle that deleted property we need to convert this to
Dictionary type.
In order to fix that When we add the accessor on any property we need to check if any property deleted upon that we need
to convert to Dictionary type instead of type.

Author: akroshg

lib/Runtime/Types/PathTypeHandler.cpp

@@ -1196,6 +1196,8 @@ namespace Js
                     }
                 }
 
+                Assert((attr & ObjectSlotAttr_Deleted) != ObjectSlotAttr_Deleted);
+
                 SetAttributesHelper(instance, propertyId, propertyIndex, attributes, (ObjectSlotAttributes)(attr | ObjectSlotAttr_Accessor));
                 // SetAttributesHelper can convert to dictionary in corner cases, e.g., if we haven't got a full path from the root. Remove this check when that's fixed.
                 if (!instance->GetTypeHandler()->IsPathTypeHandler())

lib/Runtime/Types/SimpleTypeHandler.cpp

@@ -95,6 +95,11 @@ namespace Js
             }
         }
 
+        if (HasDeletedProperties())
+        {
+            return false;
+        }
+
         return true;
     }
 
@@ -172,6 +177,21 @@ namespace Js
         return newTypeHandler;
     }
 
+    template<size_t size>
+    bool SimpleTypeHandler<size>::HasDeletedProperties()
+    {
+        for (PropertyIndex i = 0; i < propertyCount; i++)
+        {
+            if (descriptors[i].Attributes & PropertyDeleted)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+
     template<size_t size>
     PathTypeHandlerBase* SimpleTypeHandler<size>::ConvertToPathType(DynamicObject* instance)
     {

lib/Runtime/Types/SimpleTypeHandler.h

@@ -92,6 +92,8 @@ namespace Js
         ES5ArrayTypeHandler* ConvertToES5ArrayType(DynamicObject* instance);
         SimpleTypeHandler<size>* ConvertToNonSharedSimpleType(DynamicObject * instance);
 
+        bool HasDeletedProperties();
+
         BOOL GetDescriptor(PropertyId propertyId, PropertyIndex * index);
         BOOL SetAttribute(DynamicObject* instance, PropertyIndex index, PropertyAttributes attribute);
         BOOL ClearAttribute(DynamicObject* instance, PropertyIndex index, PropertyAttributes attribute);

test/Bugs/bug_6271.js

@@ -0,0 +1,27 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function testReconfigureAsAccessorProperty(f) {
+    var length = 2;
+    Object.defineProperty(f, 'length', {
+      get: function () {
+        return length;
+      },
+      set: function (v) {
+        length = v;
+      }
+    });
+  }
+  (function testSetOnInstance() {
+    function f() {}
+    delete f.length;
+    testReconfigureAsAccessorProperty(f);
+    Object.defineProperty(Function.prototype, 'length', {
+      writable: true
+    });
+    f.length = 123;
+    f.length == 123 ? print("Pass") : print('fail');
+  })();
+  

test/Bugs/rlexe.xml

@@ -623,6 +623,11 @@
       <files>bug_6277.js</files>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug_6271.js</files>
+    </default>
+  </test>
   <test>
     <default>
       <files>bug_OS23102586.js</files>