Fix except-tuple, list overflow, list kwargs — 3 major infra fixes

1. exc_isinstance: Handle tuple of exception types in except clauses.
   `except (MemoryError, OverflowError)` now works. Previously only
   single-type except clauses matched. Supports nested tuples too.

2. list_repeat/list_inplace_repeat: Add overflow checks before huge
   allocations. `[0] * sys.maxsize` now raises OverflowError instead
   of fatal OOM. Limit: 256M items (~2GB).

3. list_type_call: Reject keyword arguments. `list(sequence=[])`
   now raises TypeError("list() takes no keyword arguments").

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jgarzik

src/pyo/exception.asm

@@ -448,8 +448,17 @@ END_FUNC exc_getattr
 
 ; exc_isinstance(PyExceptionObject *exc, PyTypeObject *type) -> int (0/1)
 ; Check if exception is an instance of type, walking tp_base chain.
+; If type is a tuple, checks each element.
+extern tuple_type
 DEF_FUNC_BARE exc_isinstance
-    ; rdi = exc, rsi = target type
+    ; rdi = exc, rsi = target type (or tuple of types)
+    ; Check if rsi is a tuple
+    mov rax, [rsi + PyObject.ob_type]
+    lea rcx, [rel tuple_type]
+    cmp rax, rcx
+    je .tuple_match
+
+    ; Single type: walk tp_base chain
     mov rax, [rdi + PyExceptionObject.ob_type]
 .walk:
     test rax, rax
@@ -464,6 +473,41 @@ DEF_FUNC_BARE exc_isinstance
 .not_match:
     xor eax, eax
     ret
+
+.tuple_match:
+    ; rsi = tuple of types. Check each element.
+    push rbx
+    push r12
+    push r13
+    mov rbx, rdi               ; save exc
+    mov r12, [rsi + PyTupleObject.ob_item]       ; type payloads
+    mov r13, [rsi + PyTupleObject.ob_size]        ; count
+    xor ecx, ecx
+.tuple_loop:
+    cmp rcx, r13
+    jge .tuple_no_match
+    push rcx
+    mov rdi, rbx               ; exc
+    mov rsi, [r12 + rcx*8]    ; type element
+    ; Recursive call for nested tuples
+    call exc_isinstance
+    pop rcx
+    test eax, eax
+    jnz .tuple_found
+    inc rcx
+    jmp .tuple_loop
+.tuple_found:
+    mov eax, 1
+    pop r13
+    pop r12
+    pop rbx
+    ret
+.tuple_no_match:
+    xor eax, eax
+    pop r13
+    pop r12
+    pop rbx
+    ret
 END_FUNC exc_isinstance
 
 ; type_is_exc_subclass(PyTypeObject *type) -> int (0/1)

src/pyo/list.asm

@@ -1660,8 +1660,12 @@ DEF_FUNC list_repeat
 .rep_positive:
 
     mov r13, [rbx + PyListObject.ob_size]   ; r13 = len(list)
-    imul r14, r13, 1                         ; r14 = original length
+    mov r14, r13
     imul r14, r12                            ; r14 = total items
+    jo .rep_overflow                         ; signed overflow → MemoryError
+    ; Sanity check: total_items * 8 must fit in address space
+    cmp r14, 0x10000000                      ; 256M items limit (~2GB)
+    ja .rep_overflow
 
     ; Allocate new list
     mov rdi, r14
@@ -1711,6 +1715,12 @@ DEF_FUNC list_repeat
     pop rbx
     leave
     ret
+
+.rep_overflow:
+    extern exc_OverflowError_type
+    lea rdi, [rel exc_OverflowError_type]
+    CSTRING rsi, "too many items for list repetition"
+    call raise_exception
 END_FUNC list_repeat
 
 ;; ============================================================================
@@ -1879,6 +1889,9 @@ DEF_FUNC list_inplace_repeat, LIR_FRAME
     ; Grow items array: new_cap = old_size * count
     mov r13, rax              ; r13 = old_size
     imul rax, r12             ; rax = old_size * count = new_size
+    jo .lir_overflow           ; signed overflow → OverflowError
+    cmp rax, 0x10000000        ; 256M items limit
+    ja .lir_overflow
     push rax                  ; save new_size
 
     ; Realloc payloads
@@ -1966,6 +1979,11 @@ DEF_FUNC list_inplace_repeat, LIR_FRAME
     pop rbx
     leave
     ret
+.lir_overflow:
+    extern exc_OverflowError_type
+    lea rdi, [rel exc_OverflowError_type]
+    CSTRING rsi, "too many items for list repetition"
+    call raise_exception
 END_FUNC list_inplace_repeat
 
 ;; ============================================================================
@@ -1985,6 +2003,12 @@ DEF_FUNC list_type_call, LTC_FRAME
     mov r12, rsi            ; args
     mov r13, rdx            ; nargs
 
+    ; Reject keyword arguments
+    extern kw_names_pending
+    mov rax, [rel kw_names_pending]
+    test rax, rax
+    jnz .ltc_kwarg_error
+
     ; list() — no args: return empty list
     test r13, r13
     jz .ltc_empty
@@ -2077,6 +2101,13 @@ DEF_FUNC list_type_call, LTC_FRAME
     lea rdi, [rel exc_TypeError_type]
     CSTRING rsi, "list expected at most 1 argument"
     call raise_exception
+
+.ltc_kwarg_error:
+    ; Clear kw_names_pending to avoid stale state
+    mov qword [rel kw_names_pending], 0
+    lea rdi, [rel exc_TypeError_type]
+    CSTRING rsi, "list() takes no keyword arguments"
+    call raise_exception
 END_FUNC list_type_call
 
 ;; ============================================================================