StringBuilder的内部数据结构如下：

StringBuilder.png

添加字符串：
StringBuilder Append(String value)
当 value 的大小可以放入当前 sb，则直接字符串拷贝。

         unsafe {
             fixed (char* valuePtr = value)
             fixed (char* destPtr = &chunkChars[chunkLength])
                 string.wstrcpy(destPtr, valuePtr, valueLen);
         }

否则，需要扩容。
扩容代码：

        int newBlockLength = Math.Max(minBlockCharCount, Math.Min(Length, MaxChunkSize));

        // Copy the current block to the new block, and initialize this to point at the new buffer. 
        m_ChunkPrevious = new StringBuilder(this);
        m_ChunkOffset += m_ChunkLength;
        m_ChunkLength = 0;

        // Check for integer overflow (logical buffer size > int.MaxInt)
        if (m_ChunkOffset + newBlockLength < newBlockLength)
        {
            m_ChunkChars = null;
            throw new OutOfMemoryException();
        }
        m_ChunkChars = new char[newBlockLength];

先将当前 chunk 填满，然后将当前 chunk 的内容填入一个新建的 sb，并作为前置，然后重置当前sb，再拷贝剩余字符串内容。
每发生一次扩容时，都会多一次前置操作，从而形成了单链表，并且由m_ChunkOffset标识出每个sb的首字符在总字符串的位置。

输出
public override String ToString()

了解了如何添加，再理解如何输出就不难了。

        string ret = string.FastAllocateString(Length);
        StringBuilder chunk = this;
        unsafe {
            fixed (char* destinationPtr = ret)
            {
                do
                {
                    if (chunk.m_ChunkLength > 0)
                    {
                        // Copy these into local variables so that they are stable even in the presence of ----s (hackers might do this)
                        char[] sourceArray = chunk.m_ChunkChars;
                        int chunkOffset = chunk.m_ChunkOffset;
                        int chunkLength = chunk.m_ChunkLength;

                        // Check that we will not overrun our boundaries. 
                        if ((uint)(chunkLength + chunkOffset) <= ret.Length && (uint)chunkLength <= (uint)sourceArray.Length)
                        {
                            fixed (char* sourcePtr = sourceArray)
                                string.wstrcpy(destinationPtr + chunkOffset, sourcePtr, chunkLength);
                        }
                        else
                        {
                            throw new ArgumentOutOfRangeException("chunkLength", Environment.GetResourceString("ArgumentOutOfRange_Index"));
                        }
                    }
                    chunk = chunk.m_ChunkPrevious;
                } while (chunk != null);
            }
        }

从后向前，按照offset指示的起始位置，将内容拷贝至总的字符串。

可以看出，由于是一次性分配了所需要的所有内存，所以在【很多次循环】场景下，比String.Concat效率要高出很多。