--- a/js/src/jit/MIROps.yaml
+++ b/js/src/jit/MIROps.yaml
@@ -1660,17 +1660,16 @@
 # part of MArrayLength::foldsTo.
 - name: ObjectKeysLength
   operands:
     object: Object
   result_type: Int32
   movable: false
   congruent_to: if_operands_equal
   alias_set: custom
-  compute_range: custom
   clone: true
 
 - name: LoadUnboxedScalar
   gen_boilerplate: false
 
 - name: LoadDataViewElement
   gen_boilerplate: false
 

--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -1797,23 +1797,16 @@ void MArrayBufferViewLength::computeRang
 }
 
 void MArrayBufferViewByteOffset::computeRange(TempAllocator& alloc) {
   if constexpr (ArrayBufferObject::ByteLengthLimit <= INT32_MAX) {
     setRange(Range::NewUInt32Range(alloc, 0, INT32_MAX));
   }
 }
 
-void MObjectKeysLength::computeRange(TempAllocator& alloc) {
-  // Object.keys(..) returns an array, but this array is bounded by the number
-  // of slots / elements that can be encoded in a single object.
-  MOZ_ASSERT(type() == MIRType::Int32);
-  setRange(Range::NewUInt32Range(alloc, 0, NativeObject::MAX_SLOTS_COUNT));
-}
-
 void MTypedArrayElementSize::computeRange(TempAllocator& alloc) {
   constexpr auto MaxTypedArraySize = sizeof(double);
 
 #define ASSERT_MAX_SIZE(_, T, N)                \
   static_assert(sizeof(T) <= MaxTypedArraySize, \
                 "unexpected typed array type exceeding 64-bits storage");
   JS_FOR_EACH_TYPED_ARRAY(ASSERT_MAX_SIZE)
 #undef ASSERT_MAX_SIZE