Slightly improve dealing with error snapshots

An error in _cairo_surface_snapshot_copy_on_write() results in a snapshot in an error state and the snapshot's ->target could now point to a surface from _cairo_surface_create_in_error(). These surfaces e.g. have ->backend == NULL. Thus, anything looking at ->backend->type now explodes. This commit deals with two places which caused segfaults in this situation.

There is no test case for this, because _cairo_surface_snapshot_copy_on_write() really is not supposed to fail.

Found-while-investigating: #448 (closed) Signed-off-by: Uli Schlachter psychon@znc.in