[MERGE #5978 @pleath] Do not convert simple type to path type when deleting built-in function property

Merge pull request #5978 from pleath:5952

Catch addition of Deleted attribute in PathTypeHandler SetAttributes API's.

Author: pleath

lib/Runtime/Types/PathTypeHandler.cpp

@@ -1861,6 +1861,11 @@ namespace Js
 
     BOOL PathTypeHandlerBase::SetAttributesAtIndex(DynamicObject* instance, PropertyId propertyId, PropertyIndex index, PropertyAttributes attributes)
     {
+        if (attributes & PropertyDeleted)
+        {
+            DeleteProperty(instance, propertyId, PropertyOperation_None);
+            return true;
+        }
         return SetAttributesHelper(instance, propertyId, index, GetAttributeArray(), PropertyAttributesToObjectSlotAttributes(attributes));
     }
 

lib/Runtime/Types/SimpleTypeHandler.cpp

@@ -677,7 +677,15 @@ namespace Js
             CompileAssert(_countof(descriptors) == size);
             if (size > 1)
             {
-                SetAttribute(instance, index, PropertyDeleted);
+                if (GetIsLocked())
+                {
+                    // Prevent conversion to path type and then dictionary. Remove this when path types support deleted properties.
+                    this->ConvertToNonSharedSimpleType(instance)->SetAttribute(instance, index, PropertyDeleted);
+                }
+                else
+                {
+                    SetAttribute(instance, index, PropertyDeleted);
+                }
             }
             else
             {
@@ -1000,6 +1008,10 @@ namespace Js
                     }
                     Assert(!oldType->GetIsLocked() || instance->GetDynamicType() != oldType);
                 }
+                if (descriptors[index].Attributes & PropertyDeleted)
+                {
+                    instance->GetScriptContext()->InvalidateProtoCaches(propertyId);
+                }
                 typeHandler->descriptors[index].Attributes = attributes;
                 if (attributes & PropertyEnumerable)
                 {

test/DebuggerCommon/ES6_intl_simple_attach.js.dbg.baseline

@@ -171,8 +171,7 @@
               "caller": "Error <large string>",
               "arguments": "Error <large string>"
             },
-            "length": "number 2",
-            "name": "string "
+            "length": "number 2"
           }
         }
       }
@@ -321,8 +320,7 @@
               "caller": "Error <large string>",
               "arguments": "Error <large string>"
             },
-            "length": "number 1",
-            "name": "string "
+            "length": "number 1"
           }
         }
       }
@@ -460,8 +458,7 @@
               "caller": "Error <large string>",
               "arguments": "Error <large string>"
             },
-            "length": "number 1",
-            "name": "string "
+            "length": "number 1"
           },
           "resolvedOptions": {
             "#__proto__": {

test/Function/deleteProperty.js

@@ -0,0 +1,16 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+var l = (function () {
+    function func_0() {
+    }
+    delete func_0.length;
+    Object.defineProperty(Function.prototype, 'length', { writable: true });
+    func_0.length = 'candy';
+    return func_0.length;
+}());
+
+if (l === 'candy')
+    WScript.Echo('pass')

test/Function/rlexe.xml

@@ -226,6 +226,11 @@
       <tags>exclude_test</tags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>deleteProperty.js</files>
+    </default>
+  </test>
   <test>
     <default>
       <files>newFunction.js</files>