playground: slurp binary to memory in gvisor mode

Slurp the binary to memory before POSTing it. This simplifies retries
a bit (doesn't need to re-open the file) and sets a Content-Length
header, and checks the file size early, rather than having the backend
complain.

None of this should matter for correctness (and unnecessarily uses
more memory than before), but we're sometimes seeing timeout errors
followed by this frontend returning (and caching!) an empty response
where the backend never sees a binary arrive, so this is somewhat a
shot in the dark for now. Something's up with our internal load
balancer, perhaps. Still debugging.

Also update/add some comments.

Updates golang/go#25224

Change-Id: I12f08db8ac77743b555fe7ef56bccf8cbc45742c
Reviewed-on: https://go-review.googlesource.com/c/playground/+/215058
Reviewed-by: Alexander Rakoczy <alex@golang.org>
diff --git a/sandbox.go b/sandbox.go
index e559725..e55e814 100644
--- a/sandbox.go
+++ b/sandbox.go
@@ -370,8 +370,11 @@
 		}
 	}
 
-	// TODO: remove all this once Go 1.14 is out. This is a transitional/debug step
-	// to support both nacl & gvisor temporarily.
+	// TODO: simplify this once Go 1.14 is out. We should remove
+	// the //play:gvisor substring hack and DEBUG_FORCE_GVISOR and
+	// instead implement https://golang.org/issue/33629 to
+	// officially support different Go versions (Go tip + past two
+	// releases).
 	useGvisor := os.Getenv("GO_VERSION") >= "go1.14" ||
 		os.Getenv("DEBUG_FORCE_GVISOR") == "1" ||
 		strings.Contains(req.Body, "//play:gvisor\n")
@@ -437,12 +440,18 @@
 	rec := new(Recorder)
 	var exitCode int
 	if useGvisor {
-		f, err := os.Open(exe)
+		const maxBinarySize = 100 << 20 // copied from sandbox backend; TODO: unify?
+		if fi, err := os.Stat(exe); err != nil || fi.Size() == 0 || fi.Size() > maxBinarySize {
+			if err != nil {
+				return nil, fmt.Errorf("failed to stat binary: %v", err)
+			}
+			return nil, fmt.Errorf("invalid binary size %d", fi.Size())
+		}
+		exeBytes, err := ioutil.ReadFile(exe)
 		if err != nil {
 			return nil, err
 		}
-		defer f.Close()
-		req, err := http.NewRequestWithContext(ctx, "POST", sandboxBackendURL(), f)
+		req, err := http.NewRequestWithContext(ctx, "POST", sandboxBackendURL(), bytes.NewReader(exeBytes))
 		if err != nil {
 			return nil, err
 		}
@@ -450,7 +459,7 @@
 		if testParam != "" {
 			req.Header.Add("X-Argument", testParam)
 		}
-		req.GetBody = func() (io.ReadCloser, error) { return os.Open(exe) }
+		req.GetBody = func() (io.ReadCloser, error) { return ioutil.NopCloser(bytes.NewReader(exeBytes)), nil }
 		res, err := http.DefaultClient.Do(req)
 		if err != nil {
 			return nil, err
@@ -503,6 +512,7 @@
 	}
 	var vetOut string
 	if req.WithVet {
+		// TODO: do this concurrently with the execution to reduce latency.
 		vetOut, err = vetCheckInDir(tmpDir, goPath, useModules)
 		if err != nil {
 			return nil, fmt.Errorf("running vet: %v", err)
@@ -559,6 +569,11 @@
 	return nil
 }
 
+// sandboxBackendURL returns the URL of the sandbox backend that
+// executes binaries. This backend is required for Go 1.14+ (where it
+// executes using gvisor, since Native Client support is removed).
+//
+// This function either returns a non-empty string or it panics.
 func sandboxBackendURL() string {
 	if v := os.Getenv("SANDBOX_BACKEND_URL"); v != "" {
 		return v