How this piece of ASM.js code should be evaluated by the engine?

According to the spec, the type "int" in ASM.js does not have signedness.

The int type is the type of 32-bit integers where the signedness is not known. In asm.js, the type of a variable never has a known signedness. This allows them to be compiled as 32-bit integer registers and memory words. However, this representation creates an overlap between signed and unsigned numbers that causes an ambiguity in determining which JavaScript number they represent. For example, the bit pattern 0xffffffff could represent 4294967295 or -1, depending on the signedness. For this reason, values of the int type are disallowed from escaping into external (non-asm.js) JavaScript code.

So how does the engine evaluate the following piece of ASM.js code? Since the result could be different if the parameters x and y have different signedness. How can we generate AOT code for it?

function foo(start, end) {
  start = start|0;  // start is int.
  end = end|0;  // start is int.

  return +((end - start)|0);
}

|0 casts to a signed integer. So all the values and operations in that function are signed.

(However, for subtraction, the sign does not matter anyhow - it's a single CPU instruction for either signed or unsigned, see How the value of type "i32" is evaluated in WebAssembly?)