snapshot: Don't cause invalid reads

snapshot: Don't cause invalid reads

1. Pass clip rectangles to gtk_snapshot_push_state() that point into
   the state array.
2. g_array_set_size(len+1) the state array
3. Make that function realloc() the state array.
4. The clip rectangle now points into invalid memory
5. Use the clip array

This patch fixes things by moving step 5 to before step 2.