This one:

  map->mask = (1 << (next_bit + bits_needed)) - (1 << next_bit);

before the fix, the shift was done as an int, causing overflow
if it ever got to 1 << 31.  Sprinkle 'u's around.

Fixes https://bugs.chromium.org/p/chromium/issues/detail?id=634805