Record memory near EIP/RIP first

Checking for code-corruption is an important process in crash analysis
so it is important to record code bytes first. This was already done for
ARM and other processors so this change just moves EIP/RIP to the top of
the list.

This is important in scenarios where only a small amount of extra memory
is recorded such as in the stable channel of Chrome.

Bug: 1339513
Change-Id: I26367214ee66795c81000a0487987a130f2ea23a
Commit-Queue: Mark Mentovai <>
Reviewed-by: Mark Mentovai <>
diff --git a/snapshot/ b/snapshot/
index cb8231b..db820ad 100644
--- a/snapshot/
+++ b/snapshot/
@@ -74,6 +74,7 @@
                                        Delegate* delegate) {
 #if defined(ARCH_CPU_X86_FAMILY)
   if (context.architecture == kCPUArchitectureX86_64) {
+    MaybeCaptureMemoryAround(delegate, context.x86_64->rip);
     MaybeCaptureMemoryAround(delegate, context.x86_64->rax);
     MaybeCaptureMemoryAround(delegate, context.x86_64->rbx);
     MaybeCaptureMemoryAround(delegate, context.x86_64->rcx);
@@ -89,9 +90,9 @@
     MaybeCaptureMemoryAround(delegate, context.x86_64->r13);
     MaybeCaptureMemoryAround(delegate, context.x86_64->r14);
     MaybeCaptureMemoryAround(delegate, context.x86_64->r15);
-    MaybeCaptureMemoryAround(delegate, context.x86_64->rip);
     // Note: Shadow stack region is directly captured.
   } else {
+    MaybeCaptureMemoryAround(delegate, context.x86->eip);
     MaybeCaptureMemoryAround(delegate, context.x86->eax);
     MaybeCaptureMemoryAround(delegate, context.x86->ebx);
     MaybeCaptureMemoryAround(delegate, context.x86->ecx);
@@ -99,7 +100,6 @@
     MaybeCaptureMemoryAround(delegate, context.x86->edi);
     MaybeCaptureMemoryAround(delegate, context.x86->esi);
     MaybeCaptureMemoryAround(delegate, context.x86->ebp);
-    MaybeCaptureMemoryAround(delegate, context.x86->eip);
 #elif defined(ARCH_CPU_ARM_FAMILY)
   if (context.architecture == kCPUArchitectureARM64) {