--- a/hgext/mq.py	Sun Mar 13 15:04:13 2011 +0100
+++ b/hgext/mq.py	Sun Mar 13 16:18:46 2011 +0100
@@ -1455,9 +1455,10 @@
 
             try:
                 # might be nice to attempt to roll back strip after this
-                patchf.rename()
                 n = repo.commit(message, user, ph.date, match=match,
                                 force=True)
+                # only write patch after a successful commit
+                patchf.rename()
                 self.applied.append(statusentry(n, patchfn))
             except:
                 ctx = repo[cparents[0]]

--- a/tests/test-mq-qrefresh.t	Sun Mar 13 15:04:13 2011 +0100
+++ b/tests/test-mq-qrefresh.t	Sun Mar 13 16:18:46 2011 +0100
@@ -487,3 +487,38 @@
 
   $ cd ..
 
+Refresh with bad usernames. Mercurial used to abort on bad usernames,
+but only after writing the bad name into the patch.
+
+  $ hg init bad-usernames
+  $ cd bad-usernames
+  $ touch a
+  $ hg add a
+  $ hg qnew a
+  $ hg qrefresh -u 'foo
+  > bar'
+  transaction abort!
+  rollback completed
+  refresh interrupted while patch was popped! (revert --all, qpush to recover)
+  abort: username 'foo\nbar' contains a newline!
+  [255]
+  $ cat .hg/patches/a
+  # HG changeset patch
+  # Parent 0000000000000000000000000000000000000000
+  diff --git a/a b/a
+  new file mode 100644
+  $ hg qpush
+  applying a
+  now at: a
+  $ hg qrefresh -u ' '
+  transaction abort!
+  rollback completed
+  refresh interrupted while patch was popped! (revert --all, qpush to recover)
+  abort: empty username!
+  [255]
+  $ cat .hg/patches/a
+  # HG changeset patch
+  # Parent 0000000000000000000000000000000000000000
+  diff --git a/a b/a
+  new file mode 100644
+  $ cd ..