Populate fails to overwrite JToken value with mismatched type

[ejball]

Source/destination types

class HasToken
{
	public JToken? Value { get; set; }
}

Source/destination JSON

{"value":{}}

Expected behavior

Value should be a JObject.

Actual behavior

If Value was already set to a JToken that isn't a JObject, Populate fails with this exception: JsonSerializationException: Deserialized JSON type 'Newtonsoft.Json.Linq.JObject' is not compatible with expected type 'Newtonsoft.Json.Linq.JArray'.

This started happening with 13.0.1, presumably due to #2494.

Steps to reproduce

var jToken = JToken.Parse(@"{""value"":{}}");
var hasToken = new HasToken { Value = new JArray() };
JsonSerializer.Create().Populate(jToken.CreateReader(), hasToken);

[JamesNK]

Duplicate of #2529