cxDateEdit - An AV occurs when pressing the Left Arrow and Right Arrow keys while the cursor is positioned at the rightmost position of the selected edit value

We've had a few cases were DateEdit editors in TcxGridTableView views crash; it's generally rather intermittent and happens after moving the caret about inside the editor, but in the interests of sending you a test case I'd found a repeatable set of operations that'll lead to an exception.  If you take these steps in the EXE from the attached demo project:

Click in the top data cell; the text is selected
   Press Alt+Cursor Down; the calendar drops down
   Hit Esc; the calendar is hidden, and the text is selected
   Press Cursor Left; the carat is between the 1 and 4 of "2014"
   Press Cursor Up; no visible effect
   Press Cursor Right

…then on the final cursor key press there's an access violation.  A final right cursor key press seems to be a common factor every time we've seen the crash, but I'm fairly sure there are numerous other preceding key presses that'll get it in the state where it's about to crash.

Looking at the code where the crash happens (cxMaskEdit.pas):

Delphi
function TcxMaskEditRegExprExMode.PressRight: Boolean;  
var  
  I: Integer;  
begin  
  Result := True;  

  CursorCorrection;  
  Clear;  

  if FEdit.SelLength > 0 then  
  begin  
    if (FEdit.CursorPos = FEdit.SelStart) and  
        not FEdit.FShiftOn then  
    begin  
      FRegExpr.UpdateOn := False;  
      inherited PressRight;  
      Clear;  
      FRegExpr.UpdateOn := True;  

      Exit;  
    end  
    else if (FEdit.CursorPos = FEdit.SelStart + Fedit.SelLength) and  
        not FEdit.FShiftOn then  
      Exit;  
  end;  

  inherited PressRight;  

  if FUpdate <> '' then  
  begin  
    for I := 1 to Length(FUpdate) do  
    begin  
      FHead := FHead + FTail[I];  
      FEdit.SendMyKeyDown(VK_RIGHT, []);  
    end;  
    Delete(FTail, 1, Length(FUpdate));  
  end;  
end;  

…the exception's in the:

Delphi
FHead := FHead + FTail[I];  

line - internally FUpdate = '//', FTail = '' (i.e. empty) so the loop reads outside the valid range of FTail.