Regular execution history is limited to 128K instructions. The performance analyzer tracer can buffer more and will allow searching within a window of 400K instructions within the trace.
Another option is the heat map (hme, etc.). It tracks read and write accesses to addresses and can tell you the 'source' of the current value stored at an address.
Using "r; g" as the condition can cause stepping to run away due to resuming execution when the breakpoint hits. Using the -n option to the bx command with just "r" as the breakpoint action is better as that sets a non-stopping breakpoint. Current test versions also have bta command that makes this easier; it is the memory access version of the tracepoint (bt) command.