Fix Path.GetTempFileName on Windows (#17148)

GetTempFileNameW doesn't return the required length of the buffer; it returns the unique number used in the temporary file name.  But the calling code is using that result as a length, resulting in sometimes truncated paths, and sometimes paths that aren't at all related to the original due to state left over in a pooled buffer.

Author: stephentoub

src/mscorlib/shared/System/IO/Path.Windows.cs

@@ -165,20 +165,15 @@ public static string GetTempFileName()
             Span<char> initialBuffer = stackalloc char[PathInternal.MaxShortPath];
             var builder = new ValueStringBuilder(initialBuffer);
 
-            uint result = 0;
-            while ((result = Interop.Kernel32.GetTempFileNameW(
-                ref tempPathBuilder.GetPinnableReference(), "tmp", 0, ref builder.GetPinnableReference())) > builder.Capacity)
-            {
-                // Reported size is greater than the buffer size. Increase the capacity.
-                builder.EnsureCapacity(checked((int)result));
-            }
+            uint result = Interop.Kernel32.GetTempFileNameW(
+                ref tempPathBuilder.GetPinnableReference(), "tmp", 0, ref builder.GetPinnableReference());
 
             tempPathBuilder.Dispose();
 
             if (result == 0)
                 throw Win32Marshal.GetExceptionForLastWin32Error();
 
-            builder.Length = (int)result;
+            builder.Length = builder.RawChars.IndexOf('\0');
 
             string path = PathHelper.Normalize(ref builder);
             builder.Dispose();

src/mscorlib/shared/System/Text/ValueStringBuilder.cs

@@ -27,6 +27,7 @@ public int Length
             get => _pos;
             set
             {
+                Debug.Assert(value >= 0);
                 Debug.Assert(value <= _chars.Length);
                 _pos = value;
             }
@@ -70,6 +71,9 @@ public override string ToString()
             return s;
         }
 
+        /// <summary>Returns the underlying storage of the builder.</summary>
+        public Span<char> RawChars => _chars;
+
         /// <summary>
         /// Returns a span around the contents of the builder.
         /// </summary>