How to figure out what the address of an invalid is

Valgrind reports:

==4538== Invalid read of size 4
==4538==    at 0x822D3C6: _zval_ptr_dtor (zend.h:385)
==4538==    by 0x823C1FF: _zval_ptr_dtor_wrapper (zend_variables.c:189)
==4538==    by 0x824E1A1: zend_hash_destroy (zend_hash.c:529)
==4538==    by 0x826655A: zend_object_std_dtor (zend_objects.c:45)
==4538==    by 0x8266A28: zend_objects_free_object_storage (zend_objects.c:126)
==4538==    by 0x826C43D: zend_objects_store_del_ref_by_handle_ex (zend_objects_API.c:220)
==4538==    by 0x826C0AC: zend_objects_store_del_ref (zend_objects_API.c:172)
==4538==    by 0x823BD77: _zval_dtor_func (zend_variables.c:52)
==4538==    by 0x822B99B: _zval_dtor (zend_variables.h:35)
==4538==    by 0x822D463: _zval_ptr_dtor (zend_execute_API.c:443)
==4538==    by 0x823C开发者_开发百科1FF: _zval_ptr_dtor_wrapper (zend_variables.c:189)
==4538==    by 0x824E518: zend_hash_apply_deleter (zend_hash.c:614)
==4538==  Address 0x44c1718 is 8 bytes inside a block of size 20 free'd
==4538==    at 0x4026E9C: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==4538==    by 0x8216374: _efree (zend_alloc.c:2358)
==4538==    by 0x822D48E: _zval_ptr_dtor (zend_execute_API.c:444)
==4538==    by 0x469B2C5: zim_ASTTree___destruct (parser.c:336)
==4538==    by 0x822F8CE: zend_call_function (zend_execute_API.c:986)
==4538==    by 0x825A8E2: zend_call_method (zend_interfaces.c:97)
==4538==    by 0x8266978: zend_objects_destroy_object (zend_objects.c:112)
==4538==    by 0x826C2AD: zend_objects_store_del_ref_by_handle_ex (zend_objects_API.c:206)
==4538==    by 0x826C0AC: zend_objects_store_del_ref (zend_objects_API.c:172)
==4538==    by 0x823BD77: _zval_dtor_func (zend_variables.c:52)
==4538==    by 0x822B99B: _zval_dtor (zend_variables.h:35)
==4538==    by 0x822D463: _zval_ptr_dtor (zend_execute_API.c:443)

How can I find the address of the invalid read?

The invalid read is taking place inside a function called zend_hash_destroy().

But the memory was already deallocated by the zend_objects_destroy_object() function earlier.

The fact that this is all happening inside "zend" appears to point to a problem with "zend". If you're trying to debug PHP I'm not sure you're going to get very far using valgrind here (as much as I love this tool)...