fix(String.Format, Int32.ToString): apply custom numeric formats and stop widening a float

Three defects in .NET numeric formatting, all found while sweeping cna-samples
for sample-local reimplementations of runtime API. Converting an XNA sample's
snprintf("%02d:%02d") to the faithful String.Format("{0:00}:{1:00}") would have
been a regression rather than a fix, which is how these surfaced.

1. String::Format silently DROPPED a custom numeric format string. It carried a
   second numeric formatter of its own, and that one knew only X/x/D/d for
   integers and F/G/E for doubles, so every custom format fell through to a
   plain decimal: Format("{0:00}:{1:00}", 3, 7) returned "3:7" where .NET
   returns "03:07", and Format("{0:0.00}", 59.4) returned "59.4" instead of
   "59.40". A wrong answer with no diagnostic. fmtInt and fmtDouble now defer to
   the type's own ToString for that case, which already implements the grammar.

2. Int32::ToString had no custom-numeric path at all, though Single and Double
   both did, so int.ToString("00") threw FormatException on a format .NET
   formats fine. It now takes the same branch they do.

3. String::Format(fmt, float) forwarded to the double overload, so the argument
   was formatted through Double's round-trip digits: "{0}" on 59.4f produced
   "59.400001525878906" where .NET prints "59.4", because .NET formats the
   argument with its own Single.ToString(). FormatArg grew a Float kind.

The gate is deliberately narrower than "not a standard numeric format", which is
also true of a MALFORMED standard specifier -- "DX", "D-3",
"X99999999999999999999" -- whose behaviour tickets #1847/#1849 pinned and which
must not change. isCustomNumericPlaceholderFormat asks the narrower question the
callers mean: does the format begin with something other than a specifier letter
and contain a digit placeholder? A first attempt that delegated the whole
specifier hung StringFormatBoundaryTests.SpecifierBoundIsTheReferenceBound,
because "{0:D1000000000}" reached Int32::ToString's own padding loop, which has
no such bound -- caught by the suite, not by inspection.

Four tests, each confirmed to fail with its own fix reverted. Full suite:
17875/17875.

Author: robertvokac

modules/core/include/System/Int32.hpp

@@ -13,6 +13,8 @@
 #include <stdexcept>
 #include <string>
 #include <utility>
+#include "System/NotSupportedException.hpp"
+#include "System/detail/FloatTextFormat.hpp"
 #include "SharpRuntime/SharpRuntimeHelper.hpp"
 #include "System/ArgumentException.hpp"
 #include "System/ArgumentOutOfRangeException.hpp"
@@ -199,6 +201,31 @@ class Int32 {
      */
     static std::string ToString(SharpRuntime::intcs value, const std::string& format) {
         if (format.empty()) return std::to_string(value);
+        // .NET reads a format as standard only when it is one letter plus an optional
+        // precision. Anything else -- "00", "0.0", "#,##0" -- is a CUSTOM numeric format
+        // string, a separate grammar the standard specifiers below cannot express, and
+        // Int32 supports it exactly as Single and Double already do. Without this branch
+        // `int.ToString("00")` -- and therefore `String.Format("{0:00}", n)`, which several
+        // XNA samples use to print a two-digit clock -- raised FormatException on a format
+        // .NET formats fine.
+        if (System::detail::isCustomNumericPlaceholderFormat(format)) {
+            const System::detail::CustomNumericFormat shape =
+                System::detail::parseCustomNumericFormat(format, [] {
+                    throw System::NotSupportedException(
+                        "This custom numeric format string uses a construct that is not "
+                        "implemented: section separators, percent/permille scaling, custom "
+                        "exponent forms and escaping are not supported.");
+                });
+            bool negative = false;
+            std::string integerDigits;
+            std::string fractionDigits;
+            System::detail::splitDecimalText(std::to_string(value), negative, integerDigits,
+                                             fractionDigits);
+            System::detail::roundDecimalDigits(integerDigits, fractionDigits,
+                                               shape.hasDecimalPoint ? shape.maximumDecimals : 0);
+            return System::detail::emitCustomNumeric(negative, integerDigits, fractionDigits,
+                                                     format, shape);
+        }
         char type = format[0];
         int width = 0;
         if (format.size() > 1) {

modules/core/include/System/detail/FloatTextFormat.hpp

@@ -133,6 +133,27 @@ template <class T>
     return true;
 }
 
+/**
+ * @brief True when @p format is unambiguously a CUSTOM numeric format string.
+ *
+ * Stricter than `!isStandardNumericFormat(format)` on purpose. That test is also false for a
+ * *malformed standard* specifier -- "DX", "D-3", "X99999999999999999999" -- and those have their
+ * own long-standing, tested behaviour in the integer wrappers and in String::Format (a
+ * FormatException, or the tail ignored) that must not change. This asks the narrower question the
+ * callers actually mean: does the format begin with something other than a specifier letter and
+ * contain a digit placeholder? "00", "0.00" and "#,##0" do; every malformed standard specifier
+ * begins with its letter and is left alone.
+ *
+ * @param format The format string to classify.
+ * @return True when @p format should be handled by the custom numeric grammar.
+ */
+[[nodiscard]] inline bool isCustomNumericPlaceholderFormat(const std::string& format) {
+    if (format.empty()) return false;
+    const unsigned char first = static_cast<unsigned char>(format[0]);
+    if ((first >= 'A' && first <= 'Z') || (first >= 'a' && first <= 'z')) return false;
+    return format.find_first_of("0#") != std::string::npos;
+}
+
 /**
  * @brief The subset of .NET's custom numeric format grammar this build implements.
  *

modules/core/src/System/String.cpp

@@ -3,6 +3,10 @@
 // Portions based on .NET runtime API (MIT License, Copyright .NET Foundation and Contributors)
 #include "System/String.hpp"
 #include "System/detail/CompositeFormat.hpp"
+#include "System/detail/FloatTextFormat.hpp"
+#include "System/Double.hpp"
+#include "System/Int32.hpp"
+#include "System/Single.hpp"
 #include "System/ArgumentOutOfRangeException.hpp"
 #include "System/FormatException.hpp"
 #include "System/OutOfMemoryException.hpp"
@@ -150,16 +154,22 @@ namespace System
         // format item. `text` points at the caller's own std::string parameter, which outlives
         // the call; nothing here owns or copies it.
         struct FormatArg {
-            enum class Kind { Int, Long, Double, Text };
+            enum class Kind { Int, Long, Float, Double, Text };
             Kind                 kind = Kind::Int;
             SharpRuntime::intcs  i    = 0;
             SharpRuntime::longcs l    = 0;
+            float                f    = 0.0f;
             double               d    = 0.0;
             const std::string*   text = nullptr;
         };
 
         FormatArg argOf(SharpRuntime::intcs v)   { FormatArg a; a.kind = FormatArg::Kind::Int;    a.i = v; return a; }
         FormatArg argOf(SharpRuntime::longcs v)  { FormatArg a; a.kind = FormatArg::Kind::Long;   a.l = v; return a; }
+        // A float is NOT widened to double. Single and Double round-trip through a different
+        // number of digits, so Format("{0}", 59.4f) came out as "59.400001525878906" -- the
+        // double text of the widened float -- where .NET prints "59.4", because .NET formats the
+        // argument with its OWN Single.ToString().
+        FormatArg argOf(float v)                 { FormatArg a; a.kind = FormatArg::Kind::Float;  a.f = v; return a; }
         FormatArg argOf(double v)                { FormatArg a; a.kind = FormatArg::Kind::Double; a.d = v; return a; }
         FormatArg argOf(const std::string& v)    { FormatArg a; a.kind = FormatArg::Kind::Text;   a.text = &v; return a; }
 
@@ -211,6 +221,19 @@ namespace System
         // Format integer with .NET-style specifier (X/x=hex, D=decimal padded, else plain).
         std::string fmtInt(SharpRuntime::intcs value, std::string_view spec) {
             if (spec.empty()) return std::to_string(value);
+            // A format that is not one letter plus an optional precision is a CUSTOM numeric
+            // format string -- "00", "0.00", "#,##0" -- a separate .NET grammar the standard
+            // specifiers below cannot express. This function knew only X/x/D/d, so every custom
+            // format fell through to a plain decimal and was silently DROPPED:
+            // Format("{0:00}:{1:00}", 3, 7) returned "3:7" where .NET returns "03:07". The
+            // grammar is already implemented once, in the type's own ToString, so this defers to
+            // it rather than growing a second copy. Standard specifiers keep taking the path
+            // below unchanged, which is what preserves the specifier-tail hardening of tickets
+            // #1847/#1849 -- ToString's own tail parsing is stricter in ways Format's callers
+            // are already tested against ("{0:DX}" must yield "42", not throw).
+            if (System::detail::isCustomNumericPlaceholderFormat(std::string(spec))) {
+                return System::Int32::ToString(value, std::string(spec));
+            }
             const char sc = spec[0];
             const SpecNumber num = parseSpecNumber(spec);
             if (num.kind == SpecNumberKind::TooLarge) throwBadFormatSpecifier();
@@ -270,6 +293,11 @@ namespace System
                 auto [ptr, ec] = std::to_chars(buf.data(), buf.data() + buf.size(), value);
                 return ec == std::errc{} ? std::string(buf.data(), ptr) : std::to_string(value);
             }
+            // Same custom-format gap as fmtInt above, in the floating-point half:
+            // Format("{0:0.00}", 59.4) returned "59.4" instead of "59.40".
+            if (System::detail::isCustomNumericPlaceholderFormat(std::string(spec))) {
+                return System::Double::ToString(value, std::string(spec));
+            }
             const char sc = spec[0];
             const SpecNumber num = parseSpecNumber(spec);
             if (num.kind == SpecNumberKind::TooLarge) throwBadFormatSpecifier();
@@ -298,9 +326,20 @@ namespace System
             }
         }
 
+        // Format a float as .NET does: through Single's own ToString, never through Double's.
+        // The specifier tail is validated here first, so an oversized one is still the
+        // FormatException ticket #1849 pinned rather than a 10^9-digit precision request.
+        std::string fmtFloat(float value, std::string_view spec) {
+            if (spec.empty()) return System::Single::ToString(value);
+            const SpecNumber num = parseSpecNumber(spec);
+            if (num.kind == SpecNumberKind::TooLarge) throwBadFormatSpecifier();
+            return System::Single::ToString(value, std::string(spec));
+        }
+
         std::string renderArg(const FormatArg& arg, std::string_view spec) {
             switch (arg.kind) {
                 case FormatArg::Kind::Int:    return fmtInt(arg.i, spec);
+                case FormatArg::Kind::Float:  return fmtFloat(arg.f, spec);
                 case FormatArg::Kind::Double: return fmtDouble(arg.d, spec);
                 case FormatArg::Kind::Long:   return std::to_string(arg.l);
                 case FormatArg::Kind::Text:   return *arg.text;
@@ -838,7 +877,8 @@ namespace System
 
     std::string String::Format(const std::string& format, float arg0)
     {
-        return Format(format, static_cast<double>(arg0));
+        const FormatArg args[] = {argOf(arg0)};
+        return formatCore(format, args, 1);
     }
 
     std::string String::Format(const std::string& format, SharpRuntime::longcs arg0, SharpRuntime::longcs arg1)

modules/core/tests/System/Int32NewTests.cpp

@@ -2,6 +2,7 @@
 // Copyright (c) Robert Vokac and contributors
 // Portions based on .NET runtime API (MIT License, Copyright .NET Foundation and Contributors)
 #include <gtest/gtest.h>
+#include "System/FormatException.hpp"
 #include "System/Int32.hpp"
 
 using System::Int32;
@@ -39,3 +40,23 @@ TEST(Int32NewTests, MinMagnitude_MinValueAlwaysLoses) {
     EXPECT_EQ(Int32::MinMagnitude(Int32::MinValue, Int32::MinValue), Int32::MinValue);
     EXPECT_EQ(Int32::MinMagnitude(Int32::MinValue, Int32::MaxValue), Int32::MaxValue);
 }
+
+TEST(Int32NewTests, ToString_CustomNumericFormat) {
+    // Int32 lacked the custom-numeric path Single and Double already had, so int.ToString("00")
+    // -- and therefore String.Format("{0:00}", n) -- raised FormatException on a format .NET
+    // formats fine. Found by cna-samples SAMPLE-046, where two ported XNA samples print a clock
+    // with String.Format("{0:00}:{1:00}", minutes, seconds).
+    EXPECT_EQ(Int32::ToString(3, "00"), "03");
+    EXPECT_EQ(Int32::ToString(3, "000"), "003");
+    EXPECT_EQ(Int32::ToString(-3, "00"), "-03");
+    EXPECT_EQ(Int32::ToString(1234, "00"), "1234");
+    EXPECT_EQ(Int32::ToString(3, "0.0"), "3.0");
+}
+
+TEST(Int32NewTests, ToString_MalformedStandardSpecifierIsUnaffectedByTheCustomPath) {
+    // The custom path must not swallow a malformed STANDARD specifier: those still throw, which
+    // is what ticket #1847 pinned. The gate asks whether the format begins with something other
+    // than a specifier letter, not merely whether it fails to be a standard format.
+    EXPECT_THROW(Int32::ToString(5, "Xz"), System::FormatException);
+    EXPECT_THROW(Int32::ToString(5, "Q"), System::FormatException);
+}

modules/core/tests/System/StringTests.cpp

@@ -1120,6 +1120,37 @@ TEST(StringFormatBoundaryTests, SpecifierBoundIsTheReferenceBound) {
     EXPECT_THROW(String::Format("{0:D2147483648}", 7), System::FormatException);
 }
 
+TEST(StringFormatBoundaryTests, CustomNumericFormatIsAppliedNotDropped) {
+    // Format carried a second, partial numeric formatter that knew only X/x/D/d for integers
+    // and F/G/E for doubles, so every CUSTOM numeric format string fell through to a plain
+    // decimal and was silently DROPPED -- the wrong answer with no diagnostic. Both of these
+    // returned "3:7" and "59.4" before; .NET returns what is asserted here. Found by
+    // cna-samples SAMPLE-046: MarbleMaze and HoneycombRush both print a clock with
+    // String.Format("{0:00}:{1:00}", minutes, seconds).
+    EXPECT_EQ(String::Format("{0:00}:{1:00}", 3, 7), "03:07");
+    EXPECT_EQ(String::Format("{0:0.00}", 59.4), "59.40");
+    EXPECT_EQ(String::Format("{0:0.00}", 59.4f), "59.40");
+    EXPECT_EQ(String::Format("{0:000}", 7), "007");
+}
+
+TEST(StringFormatBoundaryTests, AFloatIsFormattedAsSingleNotAsWidenedDouble) {
+    // The float overload forwarded to the double one, so the argument was formatted through
+    // Double's round-trip digits: "{0}" on 59.4f produced "59.400001525878906". .NET formats
+    // the argument with its OWN Single.ToString().
+    EXPECT_EQ(String::Format("{0}", 59.4f), "59.4");
+    EXPECT_EQ(String::Format("{0}", 0.1f), "0.1");
+    EXPECT_EQ(String::Format("{0}", 3.1415927f), "3.1415927");
+}
+
+TEST(StringFormatBoundaryTests, CustomFormatDoesNotCaptureAMalformedStandardSpecifier) {
+    // The gate is deliberately narrower than "not a standard format": a malformed standard
+    // specifier is also not a standard format, and those have their own tested behaviour that
+    // must not change. A custom format begins with something other than a specifier letter.
+    EXPECT_EQ(String::Format("{0:DX}", 42), "42");
+    EXPECT_EQ(String::Format("{0:D-3}", 7), "007");
+    EXPECT_THROW(String::Format("{0:D1000000000}", 7), System::FormatException);
+}
+
 TEST(StringFormatBoundaryTests, NonNumericSpecifierTailDoesNotThrowStdException) {
     // Was std::invalid_argument escaping from std::stoi. This port does not implement
     // custom numeric format strings, so the value is emitted with no specifier applied.