Description:
------------
substr_count() with length=0 currently is interpreted as using length=strlen(haystack) instead. This bug has been introduced during the implementation of negative offset support.

https://3v4l.org/fdbpO

Test script:
---------------
<?php
var_dump(substr_count("aaa", "a", 0, 0));

Expected result:
----------------
int(0)

Actual result:
--------------
int(3)