diff --git a/FuzzerDataFlowTrace.cpp b/FuzzerDataFlowTrace.cpp
index 604fe15..50ffa98 100644
--- a/FuzzerDataFlowTrace.cpp
+++ b/FuzzerDataFlowTrace.cpp
@@ -10,34 +10,141 @@
 
 #include "FuzzerDataFlowTrace.h"
 #include "FuzzerIO.h"
+#include "FuzzerRandom.h"
 
 #include <cstdlib>
 #include <fstream>
+#include <sstream>
 #include <string>
 #include <vector>
 
 namespace fuzzer {
+static const char *kFunctionsTxt = "functions.txt";
+
+bool BlockCoverage::AppendCoverage(const std::string &S) {
+  std::stringstream SS(S);
+  return AppendCoverage(SS);
+}
+
+// Coverage lines have this form:
+// CN X Y Z T
+// where N is the number of the function, T is the total number of instrumented
+// BBs, and X,Y,Z, if present, are the indecies of covered BB.
+// BB #0, which is the entry block, is not explicitly listed.
+bool BlockCoverage::AppendCoverage(std::istream &IN) {
+  std::string L;
+  while (std::getline(IN, L, '\n')) {
+    if (L.empty() || L[0] != 'C')
+      continue; // Ignore non-coverage lines.
+    std::stringstream SS(L.c_str() + 1);
+    size_t FunctionId  = 0;
+    SS >> FunctionId;
+    Vector<uint32_t> CoveredBlocks;
+    while (true) {
+      uint32_t BB = 0;
+      SS >> BB;
+      if (!SS) break;
+      CoveredBlocks.push_back(BB);
+    }
+    if (CoveredBlocks.empty()) return false;
+    uint32_t NumBlocks = CoveredBlocks.back();
+    CoveredBlocks.pop_back();
+    for (auto BB : CoveredBlocks)
+      if (BB >= NumBlocks) return false;
+    auto It = Functions.find(FunctionId);
+    auto &Counters =
+        It == Functions.end()
+            ? Functions.insert({FunctionId, Vector<uint32_t>(NumBlocks)})
+                  .first->second
+            : It->second;
+
+    if (Counters.size() != NumBlocks) return false;  // wrong number of blocks.
+
+    Counters[0]++;
+    for (auto BB : CoveredBlocks)
+      Counters[BB]++;
+  }
+  return true;
+}
+
+// Assign weights to each function.
+// General principles:
+//   * any uncovered function gets weight 0.
+//   * a function with lots of uncovered blocks gets bigger weight.
+//   * a function with a less frequently executed code gets bigger weight.
+Vector<double> BlockCoverage::FunctionWeights(size_t NumFunctions) const {
+  Vector<double> Res(NumFunctions);
+  for (auto It : Functions) {
+    auto FunctionID = It.first;
+    auto Counters = It.second;
+    auto &Weight = Res[FunctionID];
+    Weight = 1000.;  // this function is covered.
+    Weight /= SmallestNonZeroCounter(Counters);
+    Weight *= NumberOfUncoveredBlocks(Counters) + 1;  // make sure it's not 0.
+  }
+  return Res;
+}
+
+void DataFlowTrace::ReadCoverage(const std::string &DirPath) {
+  Vector<SizedFile> Files;
+  GetSizedFilesFromDir(DirPath, &Files);
+  for (auto &SF : Files) {
+    auto Name = Basename(SF.File);
+    if (Name == kFunctionsTxt) continue;
+    std::ifstream IF(SF.File);
+    Coverage.AppendCoverage(IF);
+  }
+}
 
 void DataFlowTrace::Init(const std::string &DirPath,
-                         const std::string &FocusFunction) {
+                         std::string *FocusFunction,
+                         Random &Rand) {
   if (DirPath.empty()) return;
-  const char *kFunctionsTxt = "functions.txt";
   Printf("INFO: DataFlowTrace: reading from '%s'\n", DirPath.c_str());
   Vector<SizedFile> Files;
   GetSizedFilesFromDir(DirPath, &Files);
   std::string L;
+  size_t FocusFuncIdx = SIZE_MAX;
+  Vector<std::string> FunctionNames;
 
   // Read functions.txt
   std::ifstream IF(DirPlusFile(DirPath, kFunctionsTxt));
-  size_t FocusFuncIdx = SIZE_MAX;
   size_t NumFunctions = 0;
   while (std::getline(IF, L, '\n')) {
+    FunctionNames.push_back(L);
     NumFunctions++;
-    if (FocusFunction == L)
+    if (*FocusFunction == L)
       FocusFuncIdx = NumFunctions - 1;
   }
+
+  if (*FocusFunction == "auto") {
+    // AUTOFOCUS works like this:
+    // * reads the coverage data from the DFT files.
+    // * assigns weights to functions based on coverage.
+    // * chooses a random function according to the weights.
+    ReadCoverage(DirPath);
+    auto Weights = Coverage.FunctionWeights(NumFunctions);
+    Vector<double> Intervals(NumFunctions + 1);
+    std::iota(Intervals.begin(), Intervals.end(), 0);
+    auto Distribution = std::piecewise_constant_distribution<double>(
+        Intervals.begin(), Intervals.end(), Weights.begin());
+    FocusFuncIdx = static_cast<size_t>(Distribution(Rand));
+    *FocusFunction = FunctionNames[FocusFuncIdx];
+    assert(FocusFuncIdx < NumFunctions);
+    Printf("INFO: AUTOFOCUS: %zd %s\n", FocusFuncIdx,
+           FunctionNames[FocusFuncIdx].c_str());
+    for (size_t i = 0; i < NumFunctions; i++) {
+      if (!Weights[i]) continue;
+      Printf("  [%zd] W %g\tBB-tot %u\tBB-cov %u\tEntryFreq %u:\t%s\n", i,
+             Weights[i], Coverage.GetNumberOfBlocks(i),
+             Coverage.GetNumberOfCoveredBlocks(i), Coverage.GetCounter(i, 0),
+             FunctionNames[i].c_str());
+    }
+  }
+
   if (!NumFunctions || FocusFuncIdx == SIZE_MAX || Files.size() <= 1)
     return;
+
   // Read traces.
   size_t NumTraceFiles = 0;
   size_t NumTracesWithFocusFunction = 0;
diff --git a/FuzzerDataFlowTrace.h b/FuzzerDataFlowTrace.h
index 9523a01..4058451 100644
--- a/FuzzerDataFlowTrace.h
+++ b/FuzzerDataFlowTrace.h
@@ -35,9 +35,80 @@
 #include <string>
 
 namespace fuzzer {
+
+class BlockCoverage {
+ public:
+  bool AppendCoverage(std::istream &IN);
+  bool AppendCoverage(const std::string &S);
+
+  size_t NumCoveredFunctions() const { return Functions.size(); }
+
+  uint32_t GetCounter(size_t FunctionId, size_t BasicBlockId) {
+    auto It = Functions.find(FunctionId);
+    if (It == Functions.end()) return 0;
+    const auto &Counters = It->second;
+    if (BasicBlockId < Counters.size())
+      return Counters[BasicBlockId];
+    return 0;
+  }
+
+  uint32_t GetNumberOfBlocks(size_t FunctionId) {
+    auto It = Functions.find(FunctionId);
+    if (It == Functions.end()) return 0;
+    const auto &Counters = It->second;
+    return Counters.size();
+  }
+
+  uint32_t GetNumberOfCoveredBlocks(size_t FunctionId) {
+    auto It = Functions.find(FunctionId);
+    if (It == Functions.end()) return 0;
+    const auto &Counters = It->second;
+    uint32_t Result = 0;
+    for (auto Cnt: Counters)
+      if (Cnt)
+        Result++;
+    return Result;
+  }
+
+  Vector<double> FunctionWeights(size_t NumFunctions) const;
+  void clear() { Functions.clear(); }
+
+ private:
+
+  typedef Vector<uint32_t> CoverageVector;
+
+  uint32_t NumberOfCoveredBlocks(const CoverageVector &Counters) const {
+    uint32_t Res = 0;
+    for (auto Cnt : Counters)
+      if (Cnt)
+        Res++;
+    return Res;
+  }
+
+  uint32_t NumberOfUncoveredBlocks(const CoverageVector &Counters) const {
+    return Counters.size() - NumberOfCoveredBlocks(Counters);
+  }
+
+  uint32_t SmallestNonZeroCounter(const CoverageVector &Counters) const {
+    assert(!Counters.empty());
+    uint32_t Res = Counters[0];
+    for (auto Cnt : Counters)
+      if (Cnt)
+        Res = Min(Res, Cnt);
+    assert(Res);
+    return Res;
+  }
+
+  // Function ID => vector of counters.
+  // Each counter represents how many input files trigger the given basic block.
+  std::unordered_map<size_t, CoverageVector> Functions;
+};
+
 class DataFlowTrace {
  public:
-  void Init(const std::string &DirPath, const std::string &FocusFunction);
+  void ReadCoverage(const std::string &DirPath);
+  void Init(const std::string &DirPath, std::string *FocusFunction,
+            Random &Rand);
   void Clear() { Traces.clear(); }
   const Vector<uint8_t> *Get(const std::string &InputSha1) const {
     auto It = Traces.find(InputSha1);
@@ -49,6 +120,7 @@
  private:
   // Input's sha1 => DFT for the FocusFunction.
   std::unordered_map<std::string, Vector<uint8_t> > Traces;
+  BlockCoverage Coverage;
 };
 }  // namespace fuzzer
 
diff --git a/FuzzerFlags.def b/FuzzerFlags.def
index b4ec5f2..81d3f07 100644
--- a/FuzzerFlags.def
+++ b/FuzzerFlags.def
@@ -151,7 +151,9 @@
                 "after this one. Useful for fuzzers that need to do their own "
                 "argument parsing.")
 FUZZER_FLAG_STRING(focus_function, "Experimental. "
-     "Fuzzing will focus on inputs that trigger calls to this function")
+     "Fuzzing will focus on inputs that trigger calls to this function. "
+     "If -focus_function=auto and -data_flow_trace is used, libFuzzer "
+     "will choose the focus functions automatically.")
 
 FUZZER_FLAG_INT(analyze_dict, 0, "Experimental")
 FUZZER_DEPRECATED_FLAG(use_clang_coverage)
diff --git a/FuzzerLoop.cpp b/FuzzerLoop.cpp
index fd5b226..d1ad3e3 100644
--- a/FuzzerLoop.cpp
+++ b/FuzzerLoop.cpp
@@ -157,8 +157,9 @@
   AllocateCurrentUnitData();
   CurrentUnitSize = 0;
   memset(BaseSha1, 0, sizeof(BaseSha1));
-  TPC.SetFocusFunction(Options.FocusFunction);
-  DFT.Init(Options.DataFlowTrace, Options.FocusFunction);
+  auto FocusFunctionOrAuto = Options.FocusFunction;
+  DFT.Init(Options.DataFlowTrace, &FocusFunctionOrAuto , MD.GetRand());
+  TPC.SetFocusFunction(FocusFunctionOrAuto);
 }
 
 Fuzzer::~Fuzzer() {}
diff --git a/tests/FuzzerUnittest.cpp b/tests/FuzzerUnittest.cpp
index d9bdfc1..93f70b5 100644
--- a/tests/FuzzerUnittest.cpp
+++ b/tests/FuzzerUnittest.cpp
@@ -762,6 +762,92 @@
         {"B", "D"}, 3);
 }
 
+TEST(DFT, BlockCoverage) {
+  BlockCoverage Cov;
+  // Assuming C0 has 5 instrumented blocks,
+  // C1: 7 blocks, C2: 4, C3: 9, C4 never covered, C5: 15,
+
+  // Add C0
+  EXPECT_TRUE(Cov.AppendCoverage("C0 5\n"));
+  EXPECT_EQ(Cov.GetCounter(0, 0), 1U);
+  EXPECT_EQ(Cov.GetCounter(0, 1), 0U);  // not seen this BB yet.
+  EXPECT_EQ(Cov.GetCounter(0, 5), 0U);  // BB ID out of bounds.
+  EXPECT_EQ(Cov.GetCounter(1, 0), 0U);  // not seen this function yet.
+
+  EXPECT_EQ(Cov.GetNumberOfBlocks(0), 5U);
+  EXPECT_EQ(Cov.GetNumberOfCoveredBlocks(0), 1U);
+  EXPECT_EQ(Cov.GetNumberOfBlocks(1), 0U);
+
+  // Various errors.
+  EXPECT_FALSE(Cov.AppendCoverage("C0\n"));  // No total number.
+  EXPECT_FALSE(Cov.AppendCoverage("C0 7\n"));  // No total number.
+  EXPECT_FALSE(Cov.AppendCoverage("CZ\n"));  // Wrong function number.
+  EXPECT_FALSE(Cov.AppendCoverage("C1 7 7"));  // BB ID is too big.
+  EXPECT_FALSE(Cov.AppendCoverage("C1 100 7")); // BB ID is too big.
+
+  // Add C0 more times.
+  EXPECT_TRUE(Cov.AppendCoverage("C0 5\n"));
+  EXPECT_EQ(Cov.GetCounter(0, 0), 2U);
+  EXPECT_TRUE(Cov.AppendCoverage("C0 1 2 5\n"));
+  EXPECT_EQ(Cov.GetCounter(0, 0), 3U);
+  EXPECT_EQ(Cov.GetCounter(0, 1), 1U);
+  EXPECT_EQ(Cov.GetCounter(0, 2), 1U);
+  EXPECT_EQ(Cov.GetCounter(0, 3), 0U);
+  EXPECT_EQ(Cov.GetCounter(0, 4), 0U);
+  EXPECT_EQ(Cov.GetNumberOfCoveredBlocks(0), 3U);
+  EXPECT_TRUE(Cov.AppendCoverage("C0 1 3 4 5\n"));
+  EXPECT_EQ(Cov.GetCounter(0, 0), 4U);
+  EXPECT_EQ(Cov.GetCounter(0, 1), 2U);
+  EXPECT_EQ(Cov.GetCounter(0, 2), 1U);
+  EXPECT_EQ(Cov.GetCounter(0, 3), 1U);
+  EXPECT_EQ(Cov.GetCounter(0, 4), 1U);
+  EXPECT_EQ(Cov.GetNumberOfCoveredBlocks(0), 5U);
+
+  EXPECT_TRUE(Cov.AppendCoverage("C1 7\nC2 4\nC3 9\nC5 15\nC0 5\n"));
+  EXPECT_EQ(Cov.GetCounter(0, 0), 5U);
+  EXPECT_EQ(Cov.GetCounter(1, 0), 1U);
+  EXPECT_EQ(Cov.GetCounter(2, 0), 1U);
+  EXPECT_EQ(Cov.GetCounter(3, 0), 1U);
+  EXPECT_EQ(Cov.GetCounter(4, 0), 0U);
+  EXPECT_EQ(Cov.GetCounter(5, 0), 1U);
+
+  EXPECT_TRUE(Cov.AppendCoverage("C3 4 5 9\nC5 11 12 15"));
+  EXPECT_EQ(Cov.GetCounter(0, 0), 5U);
+  EXPECT_EQ(Cov.GetCounter(1, 0), 1U);
+  EXPECT_EQ(Cov.GetCounter(2, 0), 1U);
+  EXPECT_EQ(Cov.GetCounter(3, 0), 2U);
+  EXPECT_EQ(Cov.GetCounter(3, 4), 1U);
+  EXPECT_EQ(Cov.GetCounter(3, 5), 1U);
+  EXPECT_EQ(Cov.GetCounter(3, 6), 0U);
+  EXPECT_EQ(Cov.GetCounter(4, 0), 0U);
+  EXPECT_EQ(Cov.GetCounter(5, 0), 2U);
+  EXPECT_EQ(Cov.GetCounter(5, 10), 0U);
+  EXPECT_EQ(Cov.GetCounter(5, 11), 1U);
+  EXPECT_EQ(Cov.GetCounter(5, 12), 1U);
+}
+
+TEST(DFT, FunctionWeights) {
+  BlockCoverage Cov;
+  // unused function gets zero weight.
+  EXPECT_TRUE(Cov.AppendCoverage("C0 5\n"));
+  auto Weights = Cov.FunctionWeights(2);
+  EXPECT_GT(Weights[0], 0.);
+  EXPECT_EQ(Weights[1], 0.);
+
+  // Less frequently used function gets less weight.
+  Cov.clear();
+  EXPECT_TRUE(Cov.AppendCoverage("C0 5\nC1 5\nC1 5\n"));
+  Weights = Cov.FunctionWeights(2);
+  EXPECT_GT(Weights[0], Weights[1]);
+
+  // A function with more uncovered bclocks gets more weight.
+  Cov.clear();
+  EXPECT_TRUE(Cov.AppendCoverage("C0 1 2 3 5\nC1 2 4\n"));
+  Weights = Cov.FunctionWeights(2);
+  EXPECT_GT(Weights[1], Weights[0]);
+}
+
+
 TEST(Fuzzer, ForEachNonZeroByte) {
   const size_t N = 64;
   alignas(64) uint8_t Ar[N + 8] = {