CloneDetection now respects statement specific data when searching for clones.

[teemperor]

Summary

So far the CloneDetector only respected the class of each statement when searching for clones. This means that nodes that differ in any other attribute are falsely considered to be clones of each other as long as they had the same statement class. As an example, the statements a > b and a < b are currently considered to be clones of each other, even though they are obviously different.

This patch refines the way the CloneDetector collects data from each statement by providing methods for each class that will read the class-specific
attributes. These attributes are for example the operator kind for BinaryOperator statements which would prevent the false-positive result from the example above.

[teemperor]

• Expand test suite to test newly added code.

[v.g.vassilev]

I guess the question about the binary size holds here, too. What would be the impact on the binary size?

lib/Analysis/CloneDetection.cpp

82–236

Could you prefix this as // FIXME:

83

In which case this happens?

106

duplicate "for example".

147

Why do we need this? Wouldn't callAddDataStmt properly dispatch to the concrete method call?

[teemperor]

• Added FIXME: and removed duplicate "for example".

[teemperor]

• Replaced visitor-style utility functions with chained ifs to reduce binary size.

[teemperor]

Binary size increases from 33017160 Bytes to 33060464 Bytes (+40 KiB).

I'm not sure if that's too much for such a minor feature, so I've added two new revisions:

• One is the original patch with the other mentioned issues fixed (so, same +40 KiB size increase here).

• The other uses only one collect function which reduces the binary size increase to +2 KiB (but uses chained if's with dyn_cast).

The problem is that the LLVM coding standard isn't a big fan chained ifs with dyn_cast and recommends doing it in the same way as the original patch for performance reasons.

lib/Analysis/CloneDetection.cpp

83

For example

if (a < b) return 1;

would have two nullptr children in the AST (the missing 'init' and 'else' Stmts):

`-IfStmt 0x2d595f8 <line:3:3, col:22>
  |-<<<NULL>>>
  |-BinaryOperator 0x2d59598 <col:8, col:12> '_Bool' '>'
  | |-ImplicitCastExpr 0x2d59568 <col:8> 'int' <LValueToRValue>
  | | `-DeclRefExpr 0x2d59518 <col:8> 'int' lvalue Var 0x2d59418 'a' 'int'
  | `-ImplicitCastExpr 0x2d59580 <col:12> 'int' <LValueToRValue>
  |   `-DeclRefExpr 0x2d59540 <col:12> 'int' lvalue Var 0x2d59488 'b' 'int'
  |-ReturnStmt 0x2d595e0 <col:15, col:22>
  | `-IntegerLiteral 0x2d595c0 <col:22> 'int' 1
  `-<<<NULL>>>

147

callAddDataFoo would call all addDataXXX functions for Foo and all parent classes of Foo. So callAddDataStmt would only call addDataStmt because Stmt has no parent class. callAddCompoundStmt would call addDataStmt (through callAddDataStmt) and addDataCompoundStmt and so on.

[NoQ]

The natural way to avoid both heavy artillery with StmtNodes.inc and low-performance if-chains is to use a Visitor.

(Const)StmtVisitor is implemented as a huge switch, contents of which are auto-generated from StmtNodes.inc. In fact, your approach with StmtNodes.inc essentially re-implements the plain StmtVisitor. The official visitor, of course, also allows you to fall back to the parent class if the child visit method is missing.

So i believe it's worth a try to implement StmtDataCollector as an auxiliary ConstStmtVisitor. I thought the two visitors could be combined if a plain ConstStmtVisitor was used from the start, but even now it seems better to me to use an extra visitor than re-invent it(?)

No other comments so far, looks good :)

[teemperor]

• StmtDataCollector is now using ConstStmtVisitor
• Added tests for StmtDataCollector

[v.g.vassilev]

Could we stress test the implementation by running on files from llvm's/clang's test suite. For example, for a test TST we could do something like: cat TST >> tmp_TST; cat TST >> tmp_TST and run our our copy-paste checker on tmp_TST. This way we know how many clones to expect and we can cross-check how many we are able to detect.

lib/Analysis/CloneDetection.cpp

99

I'd prefer to see const Stmt *S. Could you please edit all occurrences?

110

Use just llvm::StringRef, we don't need const &.

114

Same here, const std::string &String. Is this caught by clang-format?

test/Analysis/copypaste/test-catch.cpp

30

Could you add an example like:

void non_compound_stmt1(int x)
  try { x / 0; } catch(...) { x++; }

void non_compound_stmt2(int x, float z)
  try { z / 0; } catch(...) { x++; }

[teemperor]

• Rebased patch.
• Fixed code style (const type instead of type const).
• Fixed missing const on some variables in StmtDataCollector.
• Rewrote a few comments/variable names.

[teemperor]

• Removed duplicate test case.

[teemperor]

Is there a specific situation/bug we want to test against with these tests? I looks to me as if they would mainly test against non-determinism (i.e. same statements have different data due to non-determinism).

lib/Analysis/CloneDetection.cpp

114

It hasn't complained so far or I'm missing a flag. But it's also accepting many non-LLVM like naming schemes, so I assume it's quite forgiving in this regard.

[teemperor]

• Actually removed the duplicate test now.

[NoQ]

lib/Analysis/CloneDetection.cpp

91

Maybe it's a good idea to introduce a typedef for unsigned here, because it'd be nice to be able to change it (eg., some day we may desire to switch to uint64_t).

119

Maybe just allocate the right amount of bytes during resize? Some usual trick with rounding up, eg. (x + y - 1) / y.

134

I noticed something: with this patch, you no longer consider the kind of the statement for supported statement types (even for, say, Expr), because the visitor doesn't automatically fall back to parent classes when a method for the child class is defined. Is this intentional? Or you may want to visit some statements with parent methods manually.

148

I wonder how much we can save if we use a few pointers-based hashes instead of hashing long fully-qualified names, for stuff like function decls or types.

Uhm, by the way, in fact C++ overloaded functions have same qualified names, do we consider that? I guess sub-statement hashing would most likely take care of that.

test/Analysis/copypaste/test-asm.cpp

1

Do we really need to prefix all test file names with "test-"? It's kind of obvious :)

[teemperor]

lib/Analysis/CloneDetection.cpp

134

Oh, that's indeed not how it should work! Each parent class should be visited. We could explicitly call the parent class for each visit method but I think having this automated would be good (i.e. like the old patches do it but without the resulting binary size increase). Would appreciate suggestions here :)

148

I think we'll save a lot of space with that but it only works for a single TU. I think I'll change it until we actually have multi-TU support.

Yeah, the children types prevent overload collisions (or they should if the visitor wasn't broken).

[teemperor]

• Added typedef for the contents of the data vector.
• Fixed that StmtDataCollector isn't visiting all parent classes of a statement.
• Removed 'test-' prefix from test files.
• Fixed the other problems as pointed out by Artem (Thanks!)
• Added performance remark to the qualified name strings in the data vectors.

I'm now falling back to the ConstStmtVisitor for visiting the parent statements (see the DEF_ADD_DATA macro) which is probably the best fix for the visitor problem.

clang's binary size increases with this patch to 32890440 bytes from 32863664 bytes (+26 KB).

I've kept the long qualified name strings in the data vectors in for now because that's just a performance optimization. Using the pointer values would make the code non-deterministic and breaks cross-TU support and better solutions are probably out of scope for this patch. I've added a remark that we should fix this when we look into performance optimizations.

[NoQ]

Congrats on the fantastic hack that nobody else noticed! I've a feeling we cannot add tests for that, because any test would quickly break if we change the hash, though demonstrating that we fixed the problem would still be cool (eg. take two unsupported expressions of different kind but same type, and show that they're no longer reported).

One more minor comment.

lib/Analysis/CloneDetection.cpp

127

I think resize() zero-initializes the whole new data(?)

142

This is... Beautiful... o________o
/Approves.

[teemperor]

• No longer re-initialize memory created from resize().
• Added test for checking that StmtDataCollector visits all parent classes.

[teemperor]

• s/super class/base class/g

lib/Analysis/CloneDetection.cpp

 ///
 //===----------------------------------------------------------------------===//
 
 #include "clang/Analysis/CloneDetection.h"
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/AST/Stmt.h"
+#include "clang/AST/StmtVisitor.h"
 #include "llvm/ADT/StringRef.h"
 
 using namespace clang;
 
 StmtSequence::StmtSequence(const CompoundStmt *Stmt, ASTContext &Context,
                            unsigned StartIndex, unsigned EndIndex)
     : S(Stmt), Context(&Context), StartIndex(StartIndex), EndIndex(EndIndex) {
   assert(Stmt && "Stmt must not be a nullptr");

 }
 
 SourceLocation StmtSequence::getStartLoc() const {
   return front()->getLocStart();
 }
 
 SourceLocation StmtSequence::getEndLoc() const { return back()->getLocEnd(); }
 
 namespace {
+/// \brief Collects the data of a single Stmt.
+///
+/// This class defines what a code clone is: If it collects for two statements
+/// the same data, then those two statements are considered to be clones of each
+/// other.
+class StmtDataCollector : public ConstStmtVisitor<StmtDataCollector> {
+
+  ASTContext &Context;
+  std::vector<unsigned> &CollectedData;
+
+public:
+
+  /// \brief Collects data of the given Stmt.
+  /// \param S The given statement.
+  /// \param Context The ASTContext of S.
+  /// \param D The given data vector to which all collected data is appended.
+  StmtDataCollector(const Stmt *S, ASTContext &Context,
+                    std::vector<unsigned> &D)
+      : Context(Context), CollectedData(D) {
+    Visit(S);
+  }
+
+  // Below are utility methods for appending different data to the vector.
+
+  void addData(unsigned Integer) { CollectedData.push_back(Integer); }
+
+  void addData(llvm::StringRef Str) {
+    size_t OldSize = CollectedData.size();
+
+    // Create (uninitialized) space for all bytes in our string that are known
+    // to be overwritten in this addData function call.
+    CollectedData.resize(CollectedData.size() + Str.size() / sizeof(unsigned));
+
+    // Any remaining trailing bytes that can't fill the memory of an unsigned
+    // would leave behind uninitialized memory. We fix that by initializing it
+    // with zeroes.
+    if (Str.size() % sizeof(unsigned))
+      CollectedData.push_back(0);
+
+    std::memcpy(CollectedData.data() + OldSize, Str.data(), Str.size());
+  }
+
+  void addData(const QualType &QT) { addData(QT.getAsString()); }
+
+// The functions below collect the class specific data of each Stmt subclass.
+
+// Utility macro for defining a visit method for a given class.
+#define DEF_ADD_DATA(CLASS, CODE)                                              \
+  void Visit##CLASS(const CLASS *S) { CODE; }
+
+  DEF_ADD_DATA(Stmt, { addData(S->getStmtClass()); })
+  DEF_ADD_DATA(Expr, { addData(S->getType()); })
+
+  //--- Builtin functionality ----------------------------------------------//
+  DEF_ADD_DATA(ArrayTypeTraitExpr, { addData(S->getTrait()); })
+  DEF_ADD_DATA(ExpressionTraitExpr, { addData(S->getTrait()); })
+  DEF_ADD_DATA(PredefinedExpr, { addData(S->getIdentType()); })
+  DEF_ADD_DATA(TypeTraitExpr, {
+    addData(S->getTrait());
+    for (unsigned i = 0; i < S->getNumArgs(); ++i)
+      addData(S->getArg(i)->getType());
+  })
+
+  //--- Calls --------------------------------------------------------------//
+  DEF_ADD_DATA(CallExpr,
+               { addData(S->getDirectCallee()->getQualifiedNameAsString()); })
+
+  //--- Exceptions ---------------------------------------------------------//
+  DEF_ADD_DATA(CXXCatchStmt, { addData(S->getCaughtType()); })
+
+  //--- C++ OOP Stmts ------------------------------------------------------//
+  DEF_ADD_DATA(CXXDeleteExpr, {
+    addData(S->isArrayFormAsWritten());
+    addData(S->isGlobalDelete());
+  })
+
+  //--- Casts --------------------------------------------------------------//
+  DEF_ADD_DATA(ObjCBridgedCastExpr, { addData(S->getBridgeKind()); })
+
+  //--- Miscellaneous Exprs ------------------------------------------------//
+  DEF_ADD_DATA(BinaryOperator, { addData(S->getOpcode()); })
+  DEF_ADD_DATA(UnaryOperator, { addData(S->getOpcode()); })
+
+  //--- Control flow -------------------------------------------------------//
+  DEF_ADD_DATA(GotoStmt, { addData(S->getLabel()->getName()); })
+  DEF_ADD_DATA(IndirectGotoStmt, {
+    if (S->getConstantTarget())
+      addData(S->getConstantTarget()->getName());
+  })
+  DEF_ADD_DATA(LabelStmt, { addData(S->getDecl()->getName()); })
+  DEF_ADD_DATA(MSDependentExistsStmt, { addData(S->isIfExists()); })
+  DEF_ADD_DATA(AddrLabelExpr, { addData(S->getLabel()->getName()); })
+
+  //--- Objective-C --------------------------------------------------------//
+  DEF_ADD_DATA(ObjCIndirectCopyRestoreExpr, { addData(S->shouldCopy()); })
+  DEF_ADD_DATA(ObjCPropertyRefExpr, {
+    addData(S->isSuperReceiver());
+    addData(S->isImplicitProperty());
+  })
+  DEF_ADD_DATA(ObjCAtCatchStmt, { addData(S->hasEllipsis()); })
+
+  //--- Miscellaneous Stmts ------------------------------------------------//
+  DEF_ADD_DATA(CXXFoldExpr, {
+    addData(S->isRightFold());
+    addData(S->getOperator());
+  })
+  DEF_ADD_DATA(GenericSelectionExpr, {
+    for (unsigned i = 0; i < S->getNumAssocs(); ++i) {
+      addData(S->getAssocType(i));
+    }
+  })
+  DEF_ADD_DATA(LambdaExpr, {
+    for (const LambdaCapture &C : S->captures()) {
+      addData(C.isPackExpansion());
+      addData(C.getCaptureKind());
+      if (C.capturesVariable())
+        addData(C.getCapturedVar()->getType());
+    }
+    addData(S->isGenericLambda());
+    addData(S->isMutable());
+  })
+  DEF_ADD_DATA(DeclStmt, {
+    auto numDecls = std::distance(S->decl_begin(), S->decl_end());
+    addData(static_cast<unsigned>(numDecls));
+    for (const Decl *D : S->decls()) {
+      if (const VarDecl *VD = dyn_cast<VarDecl>(D)) {
+        addData(VD->getType());
+      }
+    }
+  })
+  DEF_ADD_DATA(AsmStmt, {
+    addData(S->isSimple());
+    addData(S->isVolatile());
+    addData(S->generateAsmString(Context));
+    for (unsigned i = 0; i < S->getNumInputs(); ++i) {
+      addData(S->getInputConstraint(i));
+    }
+    for (unsigned i = 0; i < S->getNumOutputs(); ++i) {
+      addData(S->getOutputConstraint(i));
+    }
+    for (unsigned i = 0; i < S->getNumClobbers(); ++i) {
+      addData(S->getClobber(i));
+    }
+  })
+  DEF_ADD_DATA(AttributedStmt, {
+    for (const Attr *A : S->getAttrs()) {
+      addData(std::string(A->getSpelling()));
+    }
+  })
+};
+} // end anonymous namespace
+
+namespace {
 /// Generates CloneSignatures for a set of statements and stores the results in
 /// a CloneDetector object.
 class CloneSignatureGenerator {
 
   CloneDetector &CD;
   ASTContext &Context;
 
   /// \brief Generates CloneSignatures for all statements in the given statement
   /// tree and stores them in the CloneDetector.
   ///
   /// \param S The root of the given statement tree.
   /// \return The CloneSignature of the root statement.
   CloneDetector::CloneSignature generateSignatures(const Stmt *S) {
     // Create an empty signature that will be filled in this method.
     CloneDetector::CloneSignature Signature;
 
-    // The only relevant data for now is the class of the statement.
-    // TODO: Collect statement class specific data.
-    Signature.Data.push_back(S->getStmtClass());
+    // Collect all relevant data from S and put it into our
+    StmtDataCollector(S, Context, Signature.Data);
 
     // Storage for the signatures of the direct child statements. This is only
     // needed if the current statement is a CompoundStmt.
     std::vector<CloneDetector::CloneSignature> ChildSignatures;
     const CompoundStmt *CS = dyn_cast<const CompoundStmt>(S);
 
     // The signature of a statement includes the signatures of its children.
     // Therefore we create the signatures for every child and add them to the

test/Analysis/copypaste/false-positives.cpp

 // RUN: %clang_cc1 -analyze -std=c++11 -analyzer-checker=alpha.clone.CloneChecker -verify %s
 
 // This test contains false-positive reports from the CloneChecker that need to
 // be fixed.
 
 void log();
 
 int max(int a, int b) { // expected-warning{{Detected code clone.}}
   log();
   if (a > b)
     return a;
   return b;
 }
 
-// FIXME: Detect different binary operator kinds.
-int min1(int a, int b) { // expected-note{{Related code clone is here.}}
-  log();
-  if (a < b)
-    return a;
-  return b;
-}
-
 // FIXME: Detect different variable patterns.
 int min2(int a, int b) { // expected-note{{Related code clone is here.}}
   log();
   if (b > a)
     return a;
   return b;
 }

test/Analysis/copypaste/functions.cpp

int maxClone(int x, int y) { // expected-note{{Related code clone is here.}}
   log();
   if (x > y)
     return x;
   return y;
 }
 
 // Functions below are not clones and should not be reported.
 
+int min1(int a, int b) { // no-warning
+  log();
+  if (a < b)
+    return a;
+  return b;
+}
+
 int foo(int a, int b) { // no-warning
   return a + b;
 }

test/Analysis/copypaste/test-asm.cpp

+// RUN: %clang_cc1 -analyze -std=c++11 -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+int foo1(int src) {
+  int dst = src;
+  if (src < 100 && src > 0) {
+
+    asm ("mov %1, %0\n\t"
+         "add $1, %0"
+         : "=r" (dst)
+         : "r" (src));
+
+  }
+  return dst;
+}
+
+// Identical to foo1 except that it adds two instead of one, so it's no clone.
+int foo2(int src) {
+  int dst = src;
+  if (src < 100 && src > 0) {
+
+    asm ("mov %1, %0\n\t"
+         "add $2, %0"
+         : "=r" (dst)
+         : "r" (src));
+
+  }
+  return dst;
+}
+
+// Identical to foo1 except that its a volatile asm statement, so it's no clone.
+int foo3(int src) {
+  int dst = src;
+  if (src < 100 && src > 0) {
+
+    asm volatile ("mov %1, %0\n\t"
+         "add $1, %0"
+         : "=r" (dst)
+         : "r" (src));
+
+  }
+  return dst;
+}

test/Analysis/copypaste/test-attributes.cpp

+// RUN: %clang_cc1 -analyze -std=c++1z -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+int foo1(int n) {
+  int result = 0;
+  switch (n) {
+  case 33:
+    result += 33;
+    [[clang::fallthrough]];
+  case 44:
+    result += 44;
+  }
+  return result;
+}
+
+// Identical to foo1 except the missing attribute.
+int foo2(int n) {
+  int result = 0;
+  switch (n) {
+  case 33:
+    result += 33;
+    ;
+  case 44:
+    result += 44;
+  }
+  return result;
+}

test/Analysis/copypaste/test-call.cpp

+// RUN: %clang_cc1 -analyze -std=c++1z -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+bool a();
+bool b();
+
+// Calls method a with some extra code to pass the minimum complexity
+bool foo1(int x) {
+  if (x > 0)
+    return false;
+  else if (x < 0)
+    return a();
+  return true;
+}
+
+// Calls method b with some extra code to pass the minimum complexity
+bool foo2(int x) {
+  if (x > 0)
+    return false;
+  else if (x < 0)
+    return b();
+  return true;
+}

test/Analysis/copypaste/test-catch.cpp

+// RUN: %clang_cc1 -analyze -fcxx-exceptions -std=c++1z -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+bool foo1(int x) {
+  if (x > 0)
+    return false;
+  else if (x < 0)
+    try { x--; } catch (int i) {}
+  return true;
+}
+
+// Uses parenthesis instead of type
+bool foo2(int x) {
+  if (x > 0)
+    return false;
+  else if (x < 0)
+    try { x--; } catch (...) {}
+  return true;
+}
+
+// Catches a different type (long instead of int)
+bool foo3(int x) {
+  if (x > 0)
+    return false;
+  else if (x < 0)
+    try { x--; } catch (long i) {}
+  return true;
+}

test/Analysis/copypaste/test-delete.cpp

+// RUN: %clang_cc1 -analyze -std=c++1z -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+bool foo1(int x, int* a) {
+  if (x > 0)
+    return false;
+  else if (x < 0)
+    delete a;
+  return true;
+}
+
+// Explicit global delete
+bool foo2(int x, int* a) {
+  if (x > 0)
+    return false;
+  else if (x < 0)
+    ::delete a;
+  return true;
+}
+
+// Array delete
+bool foo3(int x, int* a) {
+  if (x > 0)
+    return false;
+  else if (x < 0)
+    delete[] a;
+  return true;
+}

test/Analysis/copypaste/test-dependent-exist.cpp

+// RUN: %clang_cc1 -analyze -fms-extensions -std=c++1z -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+bool foo1(int x) {
+  if (x < 0) {
+    __if_exists(x) { return false; }
+  }
+  return true;
+}
+
+// Same as above, but __if_not_exists
+bool foo2(int x) {
+  if (x < 0) {
+    __if_not_exists(x) { return false; }
+  }
+  return true;
+}

test/Analysis/copypaste/test-expr-types.cpp

+// RUN: %clang_cc1 -analyze -std=c++11 -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+
+int foo1(int a, int b) {
+  if (a > b)
+    return a;
+  return b;
+}
+
+// Different types, so not a clone
+int foo2(long a, long b) {
+  if (a > b)
+    return a;
+  return b;
+}

test/Analysis/copypaste/test-fold.cpp

+// RUN: %clang_cc1 -analyze -std=c++1z -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+int global = 0;
+
+template<typename ...Args>
+int foo1(Args&&... args) {
+  if (global > 0)
+    return 0;
+  else if (global < 0)
+    return (args + ...);
+  return 1;
+}
+
+// Different opeator in fold expression.
+template<typename ...Args>
+int foo2(Args&&... args) {
+  if (global > 0)
+    return 0;
+  else if (global < 0)
+    return (args - ...);
+  return 1;
+}
+
+// Parameter pack on a different side
+template<typename ...Args>
+int foo3(Args&&... args) {
+  if (global > 0)
+    return 0;
+  else if (global < 0)
+    return -1;
+  return (... + args);
+return 1;
+}

test/Analysis/copypaste/test-function-try-block.cpp

+// RUN: %clang_cc1 -analyze -fcxx-exceptions -std=c++1z -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// Tests if function try blocks are correctly handled.
+
+void nonCompoundStmt1(int& x)
+  try { x += 1; } catch(...) { x -= 1; } // expected-warning{{Detected code clone.}}
+
+void nonCompoundStmt2(int& x)
+  try { x += 1; } catch(...) { x -= 1; } // expected-note{{Related code clone is here.}}

test/Analysis/copypaste/test-generic.c

+// RUN: %clang_cc1 -analyze -std=c11 -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+int global;
+
+int foo1() {
+  if (global > 0)
+    return 0;
+  else if (global < 0)
+    return _Generic(global, double: 1, float: 2, default: 3);
+  return 1;
+}
+
+// Different associated type (int instead of float)
+int foo2() {
+  if (global > 0)
+    return 0;
+  else if (global < 0)
+    return _Generic(global, double: 1, int: 2, default: 4);
+  return 1;
+}
+
+// Different number of associated types.
+int foo3() {
+  if (global > 0)
+    return 0;
+  else if (global < 0)
+    return _Generic(global, double: 1, default: 4);
+  return 1;
+}

test/Analysis/copypaste/test-labels.cpp

+// RUN: %clang_cc1 -analyze -std=gnu++11 -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+
+bool foo1(int x) {
+  start:
+  if (x != 3) {
+    ++x;
+    void *ptr = &&start;
+    goto start;
+  }
+  end:
+  return false;
+}
+
+// Targeting a different label with the address-of-label operator.
+bool foo2(int x) {
+  start:
+  if (x != 3) {
+    ++x;
+    void *ptr = &&end;
+    goto start;
+  }
+  end:
+  return false;
+}
+
+// Different target label in goto
+bool foo3(int x) {
+  start:
+  if (x != 3) {
+    ++x;
+    void *ptr = &&start;
+    goto end;
+  }
+  end:
+  return false;
+}
+
+// FIXME: Can't detect same algorithm as in foo1 but with different label names.
+bool foo4(int x) {
+  foo:
+  if (x != 3) {
+    ++x;
+    void *ptr = &&foo;
+    goto foo;
+  }
+  end:
+  return false;
+}

test/Analysis/copypaste/test-lambda.cpp

+// RUN: %clang_cc1 -analyze -std=c++11 -analyzer-checker=alpha.clone.CloneChecker -verify %s
+
+// expected-no-diagnostics
+
+void foo1(int a, long b) {
+  auto l = [a, b](){};
+}
+
+void foo2(int a, long b) {
+  auto l = [&a, b](){};
+}
+
+void foo3(int a, long b) {
+  auto l = [a](){};
+}
+
+void foo4(int a, long b) {
+  auto l = [=](){};
+}
+
+void foo5(int a, long b) {
+  auto l = [&](){};
+}
+