We have three tests for invalid quantifiers in regexs: 1, 2, 3. But as far as I can tell we have no test for the SyntaxError in step 3 of the ' Term :: Atom Quantifier' section here.

That SyntaxError is slightly odd: it appears to me to be a runtime and not Early error. So, if I read the spec right, if (false) /a{2,1}/ is not an error. SpiderMonkey and JSC at least treat it as one. EDIT: and ChakraCore. v8 is the odd one out in that it treats this, per spec, as a runtime error and not a syntax error.