Summary: call to upperBound() when performing type-variable substitution on element type leads to unsoundness
Reviewed-by: jjg