diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 161c8da63cbc75fac566f336d657b69ee0ab402d..bb4fd1651b56bf56b46e698f4ce28aac1374daa3 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2013-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        CSE should work in SSA
+        https://bugs.webkit.org/show_bug.cgi?id=125430
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::run):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
 2013-12-09  Joseph Pecoraro  <pecoraro@apple.com>
 
         Remove docs/make-bytecode-docs.pl
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index d9dd3a0088efe6d0ae1df3e60f2e20735225926d..9effa26d160fd0c2b842b5b5cba22edcb0c0aaa9 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -48,15 +48,21 @@ public:
     
     bool run()
     {
-        ASSERT((cseMode == NormalCSE) == (m_graph.m_fixpointState == FixpointNotConverged));
         ASSERT(m_graph.m_fixpointState != BeforeFixpoint);
         
         m_changed = false;
         
         m_graph.clearReplacements();
         
-        for (unsigned blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
-            performBlockCSE(m_graph.block(blockIndex));
+        if (m_graph.m_form == SSA) {
+            Vector<BasicBlock*> depthFirst;
+            m_graph.getBlocksInDepthFirstOrder(depthFirst);
+            for (unsigned i = 0; i < depthFirst.size(); ++i)
+                performBlockCSE(depthFirst[i]);
+        } else {
+            for (unsigned blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
+                performBlockCSE(m_graph.block(blockIndex));
+        }
         
         return m_changed;
     }
@@ -1015,8 +1021,10 @@ private:
         if (cseMode == NormalCSE)
             m_graph.performSubstitution(node);
         
-        if (node->op() == SetLocal)
+        if (node->containsMovHint()) {
+            ASSERT(node->op() != ZombieHint);
             node->child1()->mergeFlags(NodeRelevantToOSR);
+        }
         
         switch (node->op()) {
         
@@ -1120,6 +1128,11 @@ private:
         }
             
         case Flush: {
+            if (m_graph.m_form == SSA) {
+                // FIXME: Enable Flush store elimination in SSA form.
+                // https://bugs.webkit.org/show_bug.cgi?id=125429
+                break;
+            }
             VariableAccessData* variableAccessData = node->variableAccessData();
             VirtualRegister local = variableAccessData->local();
             Node* replacement = node->child1().node();
diff --git a/Source/JavaScriptCore/dfg/DFGPlan.cpp b/Source/JavaScriptCore/dfg/DFGPlan.cpp
index 74d30b41b6116b8a6d7abe415e385cec1c5bca0b..e980bccec6d35f0fe29c1d64bbb6c634000f379c 100644
--- a/Source/JavaScriptCore/dfg/DFGPlan.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPlan.cpp
@@ -269,6 +269,7 @@ Plan::CompilationPath Plan::compileInThreadImpl(LongLivedState& longLivedState)
         performLivenessAnalysis(dfg);
         performCFA(dfg);
         performLICM(dfg);
+        performCSE(dfg);
         performLivenessAnalysis(dfg);
         performCFA(dfg);
         if (Options::validateFTLOSRExitLiveness())