gles2: Fix glDiscardFramebufferEXT

gpu/command_buffer/service/gles2_cmd_decoder.cc

Index: gpu/command_buffer/service/gles2_cmd_decoder.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index e7be28a03bc3b55679882e6bb429ca75230e5f8e..de12b550b46e5578c7277d1ff36410c195664bf1 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -5916,7 +5916,7 @@ void GLES2DecoderImpl::InvalidateFramebufferImpl(
       framebuffer->HasDepthStencilFormatAttachment();
   bool invalidate_depth = false;
   bool invalidate_stencil = false;
-  std::unique_ptr<GLenum[]> validated_attachments(new GLenum[count]);
+  std::unique_ptr<GLenum[]> validated_attachments(new GLenum[count+1]);
   GLsizei validated_count = 0;
 
   // Validates the attachments. If one of them fails, the whole command fails.
@@ -5959,7 +5959,10 @@ void GLES2DecoderImpl::InvalidateFramebufferImpl(
     validated_attachments[validated_count++] = attachment;
   }
   if (invalidate_depth && invalidate_stencil) {
-    validated_attachments[validated_count++] = GL_DEPTH_STENCIL_ATTACHMENT;
+    // We do not use GL_DEPTH_STENCIL_ATTACHMENT here because
+    // it is not a valid token for glDiscardFramebufferEXT.
+    validated_attachments[validated_count++] = GL_DEPTH_ATTACHMENT;
+    validated_attachments[validated_count++] = GL_STENCIL_ATTACHMENT;
   }
 
   // If the default framebuffer is bound but we are still rendering to an