I usually add a comment. Always cloning is safer, for sure, but also way slower. Placing that burden on the caller ensures that it's only done when required.