[Vala] Crazy Vala callback behavior

[Matthias Klumpp <matthias tenstral net>]

Hi!
This is a bit difficult to reproduce, so I'm not sure if this really is a bug.
I am mixing Vala and C code. I implement an internal class in Vala,
which defines the following callback:
  public signal Results request_whatprovides (uint filters, uint
provides, [CCode (array_length = false, array_null_terminated = true)]
string[] search);
This callback is used to forward requests to a C library, which is
itself loaded as GModule, but I don't think this matter. Anyway, I
would expect that I need to implement a callback in C using these
parameters:
 xy_request_whatprovides_cb (BackendProxy *sender,
                                PkBitfield filters,
                                PkProvidesEnum provides,
                                gchar** search,
                                gpointer user_data)
I did that in the first place and got lots of crashes if my code
wanted to access the object reference in user_data. With some
trial-and-error I figured out that this callback had a strange sixth
parameter. By implementing this:
 xy_request_whatprovides_cb (BackendProxy *sender,
                                PkBitfield filters,
                                PkProvidesEnum provides,
                                gchar** search,
                                void *i_dont_know_why_this_is_here,
                                PkPlugin *plugin)
everything works fine. Why does Vala forward this strange pointer
there? I don't even know what this is.
To complete the confusion, if I set a return value in this callback:
   return results;
where results is a GObject pointer, the search gchar** gets messed up,
meaning that the Vala C code crashes badly when trying to free it's
data. This behavior is gone when I don't return any value in this
function and instead forward it differently.
I'm really confused, because these two actions are completely
unrelated to each other.
Does someone know why this happens? Is this a Vala bug, or am I just
very stupid (don't seeing the obvious bug in this)? The code is from
an open source project, so I can easily provide more information. This
issue appears with Vala from Git master and with Vala 0.14.
Kind regards,
     Matthias