I used DbgObject.locals to return roots. GetRoots: function () { return DbgObject.locals("service", "viz::CompositorFrameSinkImpl::SubmitCompositorFrameInternal", "frame"); } with the debugger broken in inside viz::CompositorFrameSinkImpl::SubmitCompositorFrameInternal. observation: roots usually returned null. Stepping through the js code, not all the locals in the frame are returned from the debugger.