In following up this message: http://mail.openjdk.java.net/pipermail/compiler-dev/2016-October/010450.html, Alex Buckley observed:

"on JDK 9b140, javac crashes if the declaration of i uses a
bounded wildcard for B's type argument -- say B<? extends Number>.I"

I verified that claim against JDK9 tip using this case:

class A<X> { class I {} }
class Test {
  class B<Y> extends A<Y[]> {}
  B<? extends Number>.I i;
}

and I am able to reproduce the crash:

java.lang.ClassCastException: com.sun.tools.javac.code.Type$TypeMapping$3 (in module: jdk.compiler) cannot be cast to com.sun.tools.javac.code.Type$WildcardType (in module: jdk.compiler)
at com.sun.tools.javac.comp.Attr$TypeAnnotationsValidator.validateAnnotatedType(jdk.compiler@9-internal/Attr.java:4805)
at com.sun.tools.javac.comp.Attr$TypeAnnotationsValidator.validateAnnotatedType(jdk.compiler@9-internal/Attr.java:4766)
at com.sun.tools.javac.comp.Attr$TypeAnnotationsValidator.visitVarDef(jdk.compiler@9-internal/Attr.java:4677)
at com.sun.tools.javac.tree.JCTree$JCVariableDecl.accept(jdk.compiler@9-internal/JCTree.java:936)
at com.sun.tools.javac.tree.TreeScanner.scan(jdk.compiler@9-internal/TreeScanner.java:49)