I see two issues here:

1) It's easy to overflow length on platforms where size_t is 32 bits. Not directly exploitable but something to keep in mind.
2) length is unsigned here but the length argument to SetIndexedPropertiesToExternalArrayData() is a signed int. It's implementation-defined what happens when length > INT_MAX.  Most likely it will wrap around but then V8 will abort because of the negative length value.