Index: lib/sanitizer_common/scripts/sancov.py
===================================================================
--- lib/sanitizer_common/scripts/sancov.py
+++ lib/sanitizer_common/scripts/sancov.py
@@ -8,16 +8,18 @@
 import glob
 import os.path
 import struct
+import subprocess
 import sys
 
 prog_name = ""
 
 def Usage():
   print >> sys.stderr, "Usage: \n" + \
-      " " + prog_name + " [32|64] merge file1 [file2 ...]  > output\n" \
-      " " + prog_name + " [32|64] print file1 [file2 ...]\n" \
-      " " + prog_name + " [32|64] unpack file1 [file2 ...]\n" \
-      " " + prog_name + " [32|64] rawunpack file1 [file2 ...]\n"
+      " " + prog_name + " merge FILE [FILE...] > OUTPUT\n" \
+      " " + prog_name + " print FILE [FILE...]\n" \
+      " " + prog_name + " unpack FILE [FILE...]\n" \
+      " " + prog_name + " rawunpack FILE [FILE ...]\n" \
+      " " + prog_name + " missing BINARY < LIST_OF_PCS\n"
   exit(1)
 
 def CheckBits(bits):
@@ -177,11 +179,46 @@
     f_map = f[:-3] + 'map'
     UnpackOneRawFile(f, f_map)
 
+def GetInstrumentedPCs(binary):
+  cmd = "objdump -d %s | " \
+        "grep '^\s\+[0-9a-f]\+:.*\scall\(q\|\)\s\+[0-9a-f]\+ <__sanitizer_cov\(@plt\|\)>' | " \
+        "grep '^\s\+[0-9a-f]\+' -o" % binary
+  proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                          shell=True)
+  proc.stdin.close()
+  # The PCs we get from objdump are off by 4 bytes, as they point to the
+  # beginning of the callq instruction. Empirically this is true on x86 and
+  # x86_64.
+  return set(int(line.strip(), 16) + 4 for line in proc.stdout)
+
+def PrintMissing(binary):
+  if not os.path.isfile(binary):
+    raise Exception('File not found: %s' % binary)
+  instrumented = GetInstrumentedPCs(binary)
+  print >> sys.stderr, "%s: found %d instrumented PCs in %s" % (prog_name,
+                                                                len(instrumented),
+                                                                binary)
+  covered = set(int(line, 16) for line in sys.stdin)
+  print >> sys.stderr, "%s: read %d PCs from stdin" % (prog_name, len(covered))
+  missing = instrumented - covered
+  print >> sys.stderr, "%s: %d PCs missing from coverage" % (prog_name, len(missing))
+  if (len(missing) > len(instrumented) - len(covered)):
+    print >> sys.stderr, \
+        "%s: WARNING: stdin contains PCs not found in binary" % prog_name
+  for pc in sorted(missing):
+    print "0x%x" % pc
+
 if __name__ == '__main__':
   prog_name = sys.argv[0]
   if len(sys.argv) <= 2:
     Usage();
 
+  if sys.argv[1] == "missing":
+    if len(sys.argv) != 3:
+      Usage()
+    PrintMissing(sys.argv[2])
+    exit(0)
+
   file_list = []
   for f in sys.argv[2:]:
     file_list += glob.glob(f)
Index: test/asan/TestCases/Linux/coverage-missing.cc
===================================================================
--- /dev/null
+++ test/asan/TestCases/Linux/coverage-missing.cc
@@ -0,0 +1,82 @@
+// Test for "sancov.py missing ...".
+
+// RUN: ASAN_OPTIONS=coverage=1:coverage_dir=%T/coverage-missing
+
+// First case: coverage from executable. main() is called on every code path;
+// other than that, the foo and bar code paths are complementary in terms of
+// PCs covered.
+// RUN: %clangxx_asan -fsanitize-coverage=1 %s -o %t -DFOOBAR -DMAIN
+// RUN: rm -rf %T/coverage-missing
+// RUN: mkdir -p %T/coverage-missing
+// RUN: cd %T/coverage-missing
+// RUN: ASAN_OPTIONS=$ASAN_OPTIONS %t
+// RUN: %sancov print *.sancov > main.txt
+// RUN: rm *.sancov
+// RUN: [ $(cat main.txt | wc -l) == 1 ]
+// RUN: ASAN_OPTIONS=$ASAN_OPTIONS %t x
+// RUN: %sancov print *.sancov > foo.txt
+// RUN: rm *.sancov
+// RUN: [ $(cat foo.txt | wc -l) == 3 ]
+// RUN: ASAN_OPTIONS=$ASAN_OPTIONS %t x x
+// RUN: %sancov print *.sancov > bar.txt
+// RUN: rm *.sancov
+// RUN: [ $(cat bar.txt | wc -l) == 4 ]
+// RUN: %sancov missing %t < foo.txt > foo-missing.txt
+// RUN: sort main.txt foo-missing.txt -o foo-missing-with-main.txt
+// RUN: diff bar.txt foo-missing-with-main.txt
+
+// Second case: coverage from DSO. Strictly complementary code paths.
+// cd %T
+// RUN: %clangxx_asan -fsanitize-coverage=1 %s -o %dynamiclib -DFOOBAR -shared -fPIC
+// RUN: %clangxx_asan -fsanitize-coverage=1 %s %dynamiclib -o %t -DMAIN
+// RUN: LIBNAME=`basename %dynamiclib`
+// RUN: rm -rf %T/coverage-missing
+// RUN: mkdir -p %T/coverage-missing
+// RUN: cd %T/coverage-missing
+// RUN: ASAN_OPTIONS=$ASAN_OPTIONS %t x
+// RUN: %sancov print $LIBNAME.*.sancov > foo.txt
+// RUN: rm *.sancov
+// RUN: [ $(cat foo.txt | wc -l) == 2 ]
+// RUN: ASAN_OPTIONS=$ASAN_OPTIONS %t x x
+// RUN: %sancov print $LIBNAME.*.sancov > bar.txt
+// RUN: rm *.sancov
+// RUN: [ $(cat bar.txt | wc -l) == 3 ]
+// RUN: %sancov missing %dynamiclib < foo.txt > foo-missing.txt
+// RUN: diff bar.txt foo-missing.txt
+
+// XFAIL: android
+
+#include <stdio.h>
+
+void foo1();
+void foo2();
+void bar1();
+void bar2();
+void bar3();
+
+#if defined(FOOBAR)
+void foo1() { fprintf(stderr, "foo1\n"); }
+void foo2() { fprintf(stderr, "foo2\n"); }
+
+void bar1() { fprintf(stderr, "bar1\n"); }
+void bar2() { fprintf(stderr, "bar2\n"); }
+void bar3() { fprintf(stderr, "bar3\n"); }
+#endif
+
+#if defined(MAIN)
+int main(int argc, char **argv) {
+  switch (argc) {
+    case 1:
+      break;
+    case 2:
+      foo1();
+      foo2();
+      break;
+    case 3:
+      bar1();
+      bar2();
+      bar3();
+      break;
+  }
+}
+#endif