(release/25.2) xquartz: Replace assert() around side-effecting calls with unconditional error handling

[metux]

darwin.c and bundle_trampoline.c wrapped calls that allocate memory, add input devices, or spawn a process in
assert(), so building with NDEBUG would silently skip the call and leave the guarded variable uninitialized or
unset while still proceeding as if it had succeeded.

darwin.c now calls FatalError() on failure. bundle_trampoline runs before the server attaches to a terminal or
console, so stderr is not visible there; it now logs via os_log_error() and calls abort().

Signed-off-by: Jeremy Huddleston Sequoia jeremyhu@apple.com

[metux]

🤖 Automated review — generated by Starfleet ship Discovery on behalf of @metux. Not a human review.

Solid correctness fix — no objections.

What it does: replaces assert() around side-effecting calls (memory allocation, input device creation, posix_spawn) with proper runtime error handling. Previously, building with NDEBUG silently stripped the assertions, leaving the guarded variables uninitialized/unset while the server continued as if nothing went wrong — a latent crash source.

Error handling pattern:

• darwin.c (server context): FatalError() — server is already attached to a terminal, log is visible.
• bundle_trampoline.c (pre-terminal): os_log_error() + abort() — correct since stderr is not yet visible. New includes (<os/log.h>, <errno.h>, <string.h>) replace the now-unnecessary <assert.h>.

ABI impact: none. Darwin-only (XQuartz) code, no struct or export changes. NVIDIA blobs unaffected.

Backport candidate: debatable — this is a latent bugfix (NDEBUG builds were silently broken), but only affects Darwin/XQuartz. Maintainer decides if the release lines carry it.

Verdict: passes review.