Q:

iOS, KERN_INVALID_ADDRESS [UITextField keyboardInputChangedSelection:]

I'm getting the following error.
EXC_BAD_ACCESS  
KERN_INVALID_ADDRESS 
[UITextField keyboardInputChangedSelection:]

Up till this latest crash report I've been unable t reproduce this crash.
I call this view controller from didFinishLaunchingWithOptions and applicationWillEnterForeground depending on whether a passcode / pin has been set in my app.
Now here's the strange thing.
The crash occurs in the following scenario.

I run my app without a pin set, I set the pin.
Then press the home button.
This view controller pops up and I enter the pin and the view is dismissed.
I then press the home button.
I enter the app, pin screen appears.
I press home.
Then enter the app and I get a crash.

I'm using arc and I reproduced the crash on iOS6.
Here's my code below, I just can't see the problem ?
.h file
#import <UIKit/UIKit.h>

#define PVSectionFooterDefault @"Enter your PIN"
#define PVSectionFooterInvalid @"Invalid!"
#define PVSectionFooterCorrect @"Correct!"

@interface PasscodeViewController : UIViewController <UITableViewDelegate, 
       UITableViewDataSource, UITextFieldDelegate>{
    IBOutlet UITableView *passcodeTable;
    IBOutlet UILabel *lblMessage;
}
@property (nonatomic, strong) UITableView *passcodeTable;
@property (nonatomic, strong) UITextField   *txtPassword;
@property (nonatomic, strong) UILabel *lblMessage;
@end

.m file
#import "PasscodeViewController.h"
#import "AppDelegate.h"

@implementation PasscodeViewController
@synthesize passcodeTable;
@synthesize txtPassword;
@synthesize lblMessage;
- (void)viewDidLoad {
    [super viewDidLoad];

    //[passcodeTable setBackgroundColor:[UIColor clearColor]];
    //[passcodeTable setBackgroundView:nil];
    self.view.backgroundColor = [UIColor groupTableViewBackgroundColor];

    lblMessage.shadowColor       = [UIColor whiteColor];
    lblMessage.shadowOffset      = CGSizeMake(0.0, 1.0);
    lblMessage.font              = [UIFont systemFontOfSize:14];
    lblMessage.textColor         = [UIColor darkGrayColor];
    lblMessage.text = PVSectionFooterDefault;

    txtPassword.isAccessibilityElement = YES;
    txtPassword.accessibilityLabel = @"Enter PIN";
}

- (void)viewWillAppear:(BOOL)animated {
    [super viewWillAppear:animated];
    [[NSNotificationCenter defaultCenter] addObserver:self
         selector:@selector(willShowKeyboard:) 
             name:UIKeyboardWillShowNotification object:nil];
    [[NSNotificationCenter defaultCenter] addObserver:self
         selector:@selector(didShowKeyboard:) 
             name:UIKeyboardDidShowNotification object:nil];

}

- (void)viewWillDisappear:(BOOL)animated {
    [[NSNotificationCenter defaultCenter] removeObserver:self 
             name:UIKeyboardWillShowNotification object:nil];
    [[NSNotificationCenter defaultCenter] removeObserver:self 
             name:UIKeyboardDidShowNotification object:nil];
}

- (void)willShowKeyboard:(NSNotification *)notification {
    [UIView setAnimationsEnabled:NO];
}

- (void)didShowKeyboard:(NSNotification *)notification {
    [UIView setAnimationsEnabled:YES];
}

#pragma mark - Table view methods
- (NSInteger)numberOfSectionsInTableView:(UITableView *)tableView {
    return 1;
}

- (NSInteger)tableView:(UITableView *)tableView 
              numberOfRowsInSection:(NSInteger)section {
    return 1;
}

- (UITableViewCell *)tableView:(UITableView *)tableView 
                    cellForRowAtIndexPath:(NSIndexPath *)indexPath {
    static NSString *CellIdentifier = @"Cell";

    UITableViewCell *cell = [tableView 
                    dequeueReusableCellWithIdentifier:CellIdentifier];
    if (cell == nil) {
        cell = [[UITableViewCell alloc] 
                    initWithStyle:UITableViewCellStyleDefault 
                  reuseIdentifier:CellIdentifier];
        cell.selectionStyle = UITableViewCellSelectionStyleNone;

        CGRect frame = CGRectMake(cell.frame.origin.x+205, 
                    cell.frame.origin.y+7, 90, 31);

        txtPassword = [[UITextField alloc] initWithFrame:frame];
        txtPassword.delegate = self;
        txtPassword.borderStyle = UITextBorderStyleRoundedRect;
        txtPassword.font = [UIFont systemFontOfSize:17.0];
        txtPassword.backgroundColor = [UIColor whiteColor];
        txtPassword.contentVerticalAlignment = 
                     UIControlContentVerticalAlignmentCenter;
        txtPassword.keyboardType = UIKeyboardTypeNumberPad;
        txtPassword.returnKeyType = UIReturnKeyDone;    
        txtPassword.secureTextEntry = YES;
        txtPassword.clearButtonMode = UITextFieldViewModeAlways;    

        cell.textLabel.text = @"Enter PIN";

        [cell addSubview:txtPassword];

        [txtPassword becomeFirstResponder];     
    }
    return cell;
}
#pragma mark - UITextFieldDelegate
- (BOOL)textFieldShouldReturn:(UITextField *)textField {
    return YES;
}

- (BOOL) textFieldShouldClear:(UITextField *)textField {
    lblMessage.text = PVSectionFooterDefault;   
    return YES;
}

- (BOOL)textField:(UITextField *)textField 
           shouldChangeCharactersInRange:(NSRange)range 
                       replacementString:(NSString *)string {
    BOOL res = TRUE;
    NSString *newString = [textField.text 
             stringByReplacingCharactersInRange:range 
                                     withString:string];

    if ([newString length] == 4) {
        NSUserDefaults *myDefaults = [NSUserDefaults standardUserDefaults];
        NSString *strPassword = [myDefaults stringForKey:@"pass"];

        if (strPassword == nil) {
            strPassword = @"";
        }

        if (![newString isEqualToString:strPassword]) {
            lblMessage.text = PVSectionFooterInvalid;
        } else {
            lblMessage.text = PVSectionFooterCorrect;

            AppDelegate *appDel = (AppDelegate*) 
                        [[UIApplication sharedApplication] delegate];
            appDel.gbooShowingGetStartedPasswordAsk = FALSE;
            [self.view removeFromSuperview];
        }
    } else if ([newString length] < 4) {
        lblMessage.text = PVSectionFooterDefault;
    }

    res = !([newString length] > 4);

    return res;
}

- (void)didReceiveMemoryWarning {
    [super didReceiveMemoryWarning];
}

- (void)viewDidUnload {
    [super viewDidUnload];
}
@end

app delegate did launch
if (![strPassword isEqualToString:@""]) {
        self.gbooShowingGetStartedPasswordAsk = TRUE;

        lvc = [[PasscodeViewController alloc] 
               initWithNibName:@"PasscodeView" bundle:nil];

        lvc.view.frame = CGRectMake(0, 20, 320, 460); 

        [window addSubview:lvc.view];
    }

and....
- (void)applicationWillEnterForeground:(UIApplication *)application {
    NSUserDefaults *myDefaults = [NSUserDefaults standardUserDefaults];

    if (self.gbooShowingGetStartedPasswordAsk == FALSE) {

        NSString *strPassword = [myDefaults stringForKey:@"pass"];
        if (strPassword == nil) {
            strPassword = @"";
        }

        if (![strPassword isEqualToString:@""]) {
            lvc = [[PasscodeViewController alloc] 
                   initWithNibName:@"PasscodeView" bundle:nil];
            int th = self.window.frame.size.height;
            lvc.view.frame = CGRectMake(0, 20, 320, th); 

            lvc.view.backgroundColor = [UIColor groupTableViewBackgroundColor];

            [window addSubview:lvc.view];
        }
    }
}

A:

Consider when lvc is not nil, and has a superview, and applicationWillEnterForeground: is called, and takes the branch into the main block of code there. You assign lvc to a new instance of a PasscodeViewController, which likely causes the old value of lvc to be deallocated. However, its view property has a superview, so is not deallocated along with it. These living objects may yet produce notifications or actions that the deallocated view controller is still listening to. I also notice that you're not always unsubscribing from notifications in dealloc or niling the text field's delegate.
My suggestions, then, are 1) make sure you remove lvc's view before instantiating another instance and 2) make sure your PasscodeViewController's dealloc method cleans up possibly dangling references that NSNotificationCenter has.
Your applicationWillEnterForeground: method becomes:
- (void)applicationWillEnterForeground:(UIApplication *)application {
    NSUserDefaults *myDefaults = [NSUserDefaults standardUserDefaults];

    if (self.gbooShowingGetStartedPasswordAsk == FALSE) {

        NSString *strPassword = [myDefaults stringForKey:@"pass"];
        if (strPassword == nil) {
            strPassword = @"";
        }

        if (![strPassword isEqualToString:@""]) {
            [lvc.view removeFromSuperview]; // This line prevents the view from persisting
            lvc = [[PasscodeViewController alloc] 
                   initWithNibName:@"PasscodeView" bundle:nil];
            int th = self.window.frame.size.height;
            lvc.view.frame = CGRectMake(0, 20, 320, th); 

            lvc.view.backgroundColor = [UIColor groupTableViewBackgroundColor];

            [window addSubview:lvc.view];
        }
    }
}

Your PasscodeViewController's dealloc should look like this:
- (void)dealloc
{
    [[NSNotificationCenter defaultCenter] removeObserver:self];
    if (txtPassword.delegate == self) {
        txtPassword.delegate = nil; //docs indicate this is still an `assign` property so is not auto-zeroing in ARC and iOS 5+
    }
}

With these changes, there should be no more dangling references to a deallocated view controller, and no orphaned views in your view hierarchy.

