Issue in setting accessor in PathTypeHandlerWithAttr

When the property is deleted (say when we are in SimpleTypeHandler) and then later
if we create an accessor on the same property we have converted the type handler to PathTypeHandlerWithAttr.
But during setting the accessor on that slot we haven't removed the is_deleted attribute.
So when we try to get the property - we don't get that from the PathTypeHandlerWithAttr handler.
Fixed that by removing that attribute when we do SetAccessor.

lib/Runtime/Types/PathTypeHandler.cpp

@@ -1196,7 +1196,7 @@ namespace Js
                     }
                 }
 
-                SetAttributesHelper(instance, propertyId, propertyIndex, attributes, (ObjectSlotAttributes)(attr | ObjectSlotAttr_Accessor));
+                SetAttributesHelper(instance, propertyId, propertyIndex, attributes, (ObjectSlotAttributes)((attr & ~ObjectSlotAttr_Deleted) | ObjectSlotAttr_Accessor));
                 // SetAttributesHelper can convert to dictionary in corner cases, e.g., if we haven't got a full path from the root. Remove this check when that's fixed.
                 if (!instance->GetTypeHandler()->IsPathTypeHandler())
                 {

test/Bugs/bug_6271.js

@@ -0,0 +1,27 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function testReconfigureAsAccessorProperty(f) {
+    var length = 2;
+    Object.defineProperty(f, 'length', {
+      get: function () {
+        return length;
+      },
+      set: function (v) {
+        length = v;
+      }
+    });
+  }
+  (function testSetOnInstance() {
+    function f() {}
+    delete f.length;
+    testReconfigureAsAccessorProperty(f);
+    Object.defineProperty(Function.prototype, 'length', {
+      writable: true
+    });
+    f.length = 123;
+    f.length == 123 ? print("Pass") : print('fail');
+  })();
+

test/Bugs/rlexe.xml

@@ -623,6 +623,11 @@
       <files>bug_6277.js</files>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug_6271.js</files>
+    </default>
+  </test>
   <test>
     <default>
       <files>bug_OS23102586.js</files>