[php] fixed array writing at the length of an array (fixes #6874)

std/php/_std/Array.hx

@@ -192,8 +192,10 @@ class Array<T> implements ArrayAccess<Int,T> {
 
 	@:noCompletion
 	function offsetSet( offset:Int, value:T ) : Void {
-		if (length < offset) {
-			arr = Global.array_pad(arr, offset + 1, null);
+		if (length <= offset) {
+			if(length < offset) {
+				arr = Global.array_pad(arr, offset + 1, null);
+			}
 			length = offset + 1;
 		}
 		arr[offset] = value;

tests/unit/src/unitstd/Array.unit.hx

@@ -4,6 +4,8 @@
 var a = [];
 a[4] = 1;
 a.length == 5;
+a[a.length] = 1;
+a.length == 6;
 
 // concat
 [].concat([]) == [];