An error in _cairo_surface_snapshot_copy_on_write() results in a
snapshot in an error state and the snapshot's ->target could now point
to a surface from _cairo_surface_create_in_error(). These surfaces e.g.
have ->backend == NULL. Thus, anything looking at ->backend->type now
explodes. This commit deals with two places which caused segfaults in
this situation.

There is no test case for this, because
_cairo_surface_snapshot_copy_on_write() really is not supposed to fail.

Found-while-investigating: #448


Signed-off-by: Uli Schlachter <psychon@znc.in>