FULL PRODUCT VERSION :
Java HotSpot(TM) Client VM (build 1.6.0-b105, mixed mode, sharing)

A DESCRIPTION OF THE PROBLEM :
There is still a loophole related to wildcard substitution.
In the attached example, Eppb's second parameter extends a box of a box of its first param. Applied to  Ebbp<?,?> this means the second parameter has Box<Box<?>> as upperbound, which is wrong.

According to bug 5044625 this should already have been fixed by applying capture conversion on the left-hand side of supertype, but apparently the change there wasn't enough.


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
public class Break {
	public static void main(String[] args) {
		Ebbp<A,Box<Box<A>>> realFrom = new Ebbp<A,Box<Box<A>>>(new Box<Box<A>>(new Box<A>(new A())));
		caster(realFrom).q.p = new Box<B>(new B());
		A a = realFrom.q.p.p;
	}
	
	static Ebbp<?,? extends Box<Box<?>>> caster(Ebbp<?,?> from) {
		Box<Ebbp<?,?>> boxedFrom = new Box<Ebbp<?,?>>(from);
		Box<? extends Ebbp<?,? extends Box<Box<?>>>> boxedTo = boxedFrom;
		return boxedTo.p;
	}
}

class Box<P> {
	P p;
	Box(P p) {this.p = p;}
}

class Ebbp<P, Q extends Box<Box<P>>> {
	Q q;
	Ebbp(Q q) {this.q = q;}
}

class A {}
class B {}
---------- END SOURCE ----------