_vte_matcher objects are stored in a GCache keyed by the terminfo data, or as a singleton if the patch from bug 728900 comment 13 is already applied. This is so that the same matcher is shared among many VteTerminal objects.

The object, however, contains a _vte_matcher_free_params_array() method which alters the free_params field. It kinda immediately frees some pointers (but what does it have to do with the matcher?), and/or registers them to be freed later? I don't understand that code at all.

vte.c has this in vte_terminal_process_incoming():

next_match:
                if (G_LIKELY(params != NULL)) {
                        /* Free any parameters we don't care about any more. */
                        _vte_matcher_free_params_array(terminal->pvt->matcher,
                                        params);
                }

which looks like it's manipulating the matcher's free_params field, as if it was its own, rather than shared across multiple terminals.

I don't understand what's going on, but it's really fishy.