Prevent separator buffer overruns in string.Join

[tannergooding]

String.JoinCore already anticipates concurrent input mutation and retries with a defensive copy when the copies do not match the allocated length. However, it only checked capacity for values: a value could consume the remaining space, after which the unchecked separator write could overrun the result buffer.

Use a destination span bounded by the allocated string's length for both value and separator writes, advancing it after each successful copy. Preserve the single-character separator fast path and the existing defensive-copy retry, including when a copy fails after exhausting the destination.

Add an outer-loop concurrency theory covering separator lengths 1, 2, and 4000 with mutation at two input positions. The test triggered a heap-integrity assertion on the unmodified checked runtime. With the fix, all six cases pass; the full StringTests run had 2,195 passes and seven existing platform skips. After the final range-syntax edit, the checked CoreLib rebuild and all 73 Join tests passed.

Local Release BenchmarkDotNet comparisons showed unchanged allocations. Throughput measurements were noisy and inconclusive; this does not establish performance neutrality.

Resolves #134515

Note

This PR description was drafted by GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-runtime
See info in area-owners.md if you want to be subscribed.

[Copilot]

Copilot review overview

🟢 Approval recommended

All reviewed changes are covered by passing regression tests with no unresolved blocking issues.

Review effort: Lite
Findings: None

What changed in this PR

Fixes a concurrent-mutation buffer overrun in String.Join by bounding separator and value writes.

Changes:

• Uses bounded destination spans with safe copy retries.
• Adds regression tests for varied separator lengths and mutation positions.

File	Description
src/​libraries/​System.Private.CoreLib/​src/​System/​String.Manipulation.cs	Bounds result-buffer writes and preserves defensive-copy retry behavior.
src/​libraries/​Common/​tests/​Tests/​System/​StringTests.cs	Adds concurrent-mutation regression coverage.

[tannergooding]

/ba-g unrelated failure