diff --git a/JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time.js b/JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time.js
new file mode 100644
index 0000000000000..2611454cf3044
--- /dev/null
+++ b/JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time.js
@@ -0,0 +1,35 @@
+//@ runDefault("--jitPolicyScale=0.1")
+
+let trigger = false;
+
+function cb() {
+    if (trigger) {
+        Object.defineProperty(Array.prototype, 0, {
+            get() { return 42; }, configurable: true
+        });
+    }
+}
+noInline(cb);
+
+function collect() { gc(); }
+noInline(collect);
+
+function opt() {
+    let a = new Array(5);
+    a[0] = 1.1;
+    a[1] = 2.2;
+    a[2] = 3.3;
+    a[3] = 4.4;
+    a[4] = 5.5;
+    cb();
+    collect();
+    return a[0] + a[1] + a[2] + a[3] + a[4];
+}
+noInline(opt);
+
+for (let i = 0; i < 1000; i++)
+    opt();
+
+trigger = true;
+opt();
+gc();
diff --git a/Source/JavaScriptCore/ftl/FTLOperations.cpp b/Source/JavaScriptCore/ftl/FTLOperations.cpp
index d02c76c8578e4..4b4d59d411170 100644
--- a/Source/JavaScriptCore/ftl/FTLOperations.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOperations.cpp
@@ -112,10 +112,17 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationPopulateObjectInOSR, void, (JSGlobalO
             // empty JSValue is not an Int32. Contiguous is also handled here for the debug ASSERT
             // in putDirectIndex that null-derefs on the empty JSValue. Write directly into the
             // butterfly to preserve the indexing type.
+            //
+            // If the VM had a bad time between FTL compilation and this OSR exit, the Array was
+            // switched to SlowPutArrayStorage in operationMaterializeObjectInOSR. A hole (empty
+            // JSValue) must then be cleared in the ArrayStorage vector rather than the contiguous
+            // butterfly to match the rematerialized layout.
             if (hasDouble(array->indexingType()) && value.isNumber() && std::isnan(value.asNumber())) [[unlikely]]
                 array->butterfly()->contiguousDouble().atUnsafe(index) = PNaN;
             else if ((hasInt32(array->indexingType()) || hasContiguous(array->indexingType())) && !value) [[unlikely]]
                 array->butterfly()->contiguous().atUnsafe(index).setStartingValue(JSValue());
+            else if (hasAnyArrayStorage(array->indexingType()) && !value) [[unlikely]]
+                array->butterfly()->arrayStorage()->m_vector[index].clear();
             else
                 array->putDirectIndex(globalObject, index, value);
 
@@ -308,7 +315,13 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationMaterializeObjectInOSR, HeapCell*, (J
     }
 
     case PhantomNewArrayWithButterfly: {
-        Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(materialization->indexingType());
+        // Rematerialized butterflies are always non-ArrayStorage. However, isHavingABadTime could
+        // have become true between the FTL compilation and the rematerialization, which would have
+        // switched arrayStructureForIndexingTypeDuringAllocation to SlowPutArrayStorage for all
+        // indexing types. To avoid a layout mismatch, the original Array structure is used to
+        // rematerialize the Array initially. If we're having a bad time, the layout is switched to
+        // SlowPutArrayStorage below.
+        Structure* structure = globalObject->originalArrayStructureForIndexingType(materialization->indexingType());
 
         Butterfly* butterfly = nullptr;
         for (unsigned i = 0; i < materialization->properties().size(); ++i) {
@@ -349,6 +362,14 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationMaterializeObjectInOSR, HeapCell*, (J
                 butterfly->contiguous().atUnsafe(index).setStartingValue(jsNumber(sentinel));
         }
 
+        if (globalObject->isHavingABadTime()) [[unlikely]] {
+#if ASSERT_ENABLED
+            Structure* originalStructure = globalObject->arrayStructureForIndexingTypeDuringAllocation(materialization->indexingType());
+            ASSERT(!originalStructure || hasSlowPutArrayStorage(originalStructure->indexingType()));
+#endif
+            result->switchToSlowPutArrayStorage(vm);
+        }
+
         return result;
     }