Firefox and Chrome both run web fonts through the OpenType Sanitizer, which rewrites the font file. One of the things it does is clamp line gap metrics so that they aren't negative.

WebKit got a compatibility bug about this, since WebKit wasn't doing the same clamping. I've committed a change in WebKit to align with the other browsers and perform the clamping.

Because now all the browsers agree, and it is de-facto required for the web, the CSS fonts spec should say so (somewhere).