diff --git a/terraform/context.go b/terraform/context.go
index 4411dea56b..9ef0050d84 100644
--- a/terraform/context.go
+++ b/terraform/context.go
@@ -487,13 +487,12 @@ func (c *Context) applyWalkFn() depgraph.WalkFunc {
 			}
 		}
 
-		// TODO(mitchellh): we need to verify the diff doesn't change
-		// anything and that the diff has no computed values (pre-computed)
-
-		// If we don't have a diff, just make an empty one
+		// This should never happen because we check if Diff.Empty above.
+		// If this happened, then the diff above returned a bad diff.
 		if diff == nil {
-			diff = new(ResourceDiff)
-			diff.init()
+			return fmt.Errorf(
+				"%s: diff became nil during Apply. This is a bug with " +
+					"the resource provider. Please report a bug.")
 		}
 
 		// If we do not have any connection info, initialize
diff --git a/terraform/context_test.go b/terraform/context_test.go
index 9a79feed08..5560248e9b 100644
--- a/terraform/context_test.go
+++ b/terraform/context_test.go
@@ -408,6 +408,31 @@ func TestContextApply_compute(t *testing.T) {
 	}
 }
 
+func TestContextApply_nilDiff(t *testing.T) {
+	c := testConfig(t, "apply-good")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	ctx := testContext(t, &ContextOpts{
+		Config: c,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+	})
+
+	if _, err := ctx.Plan(nil); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	p.DiffFn = func(*ResourceState, *ResourceConfig) (*ResourceDiff, error) {
+		return nil, nil
+	}
+
+	if _, err := ctx.Apply(); err == nil {
+		t.Fatal("should error")
+	}
+}
+
 func TestContextApply_Provisioner_compute(t *testing.T) {
 	c := testConfig(t, "apply-provisioner-compute")
 	p := testProvider("aws")