Issue in setting accessor in PathTypeHandlerWithAttr

lib/Runtime/Types/PathTypeHandler.cpp

@@ -1196,6 +1196,8 @@ namespace Js
                     }
                 }
 
+                Assert((attr & ObjectSlotAttr_Deleted) != ObjectSlotAttr_Deleted);
+
                 SetAttributesHelper(instance, propertyId, propertyIndex, attributes, (ObjectSlotAttributes)(attr | ObjectSlotAttr_Accessor));
                 // SetAttributesHelper can convert to dictionary in corner cases, e.g., if we haven't got a full path from the root. Remove this check when that's fixed.
                 if (!instance->GetTypeHandler()->IsPathTypeHandler())

lib/Runtime/Types/SimpleTypeHandler.cpp

@@ -95,6 +95,11 @@ namespace Js
             }
         }
 
+        if (HasDeletedProperties())
+        {
+            return false;
+        }
+
         return true;
     }
 
@@ -172,6 +177,21 @@ namespace Js
         return newTypeHandler;
     }
 
+    template<size_t size>
+    bool SimpleTypeHandler<size>::HasDeletedProperties()
+    {
+        for (PropertyIndex i = 0; i < propertyCount; i++)
+        {
+            if (descriptors[i].Attributes & PropertyDeleted)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+
     template<size_t size>
     PathTypeHandlerBase* SimpleTypeHandler<size>::ConvertToPathType(DynamicObject* instance)
     {

lib/Runtime/Types/SimpleTypeHandler.h

@@ -92,6 +92,8 @@ namespace Js
         ES5ArrayTypeHandler* ConvertToES5ArrayType(DynamicObject* instance);
         SimpleTypeHandler<size>* ConvertToNonSharedSimpleType(DynamicObject * instance);
 
+        bool HasDeletedProperties();
+
         BOOL GetDescriptor(PropertyId propertyId, PropertyIndex * index);
         BOOL SetAttribute(DynamicObject* instance, PropertyIndex index, PropertyAttributes attribute);
         BOOL ClearAttribute(DynamicObject* instance, PropertyIndex index, PropertyAttributes attribute);

test/Bugs/bug_6271.js

@@ -0,0 +1,27 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function testReconfigureAsAccessorProperty(f) {
+    var length = 2;
+    Object.defineProperty(f, 'length', {
+      get: function () {
+        return length;
+      },
+      set: function (v) {
+        length = v;
+      }
+    });
+  }
+  (function testSetOnInstance() {
+    function f() {}
+    delete f.length;
+    testReconfigureAsAccessorProperty(f);
+    Object.defineProperty(Function.prototype, 'length', {
+      writable: true
+    });
+    f.length = 123;
+    f.length == 123 ? print("Pass") : print('fail');
+  })();
+

test/Bugs/rlexe.xml

@@ -623,6 +623,11 @@
       <files>bug_6277.js</files>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug_6271.js</files>
+    </default>
+  </test>
   <test>
     <default>
       <files>bug_OS23102586.js</files>