2.15.0 throws NPE when deserializing a polymorphic with unknown properties

[mishako]

Describe the bug

This line throws NullPointerException:

https://github.com/FasterXML/jackson-databind/blob/2.15/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java#L1749

if (unknownTokens != null) {
  // need to add END_OBJECT marker first
  unknownTokens.writeEndObject();
  JsonParser p2 = unknownTokens.asParser(p.streamReadConstraints()); <-- !!! HERE !!!
  p2.nextToken(); // to get to first data field
  bean = subDeser.deserialize(p2, ctxt, bean);
}

Exception in thread "main" java.lang.NullPointerException:
Cannot invoke "com.fasterxml.jackson.core.JsonParser.streamReadConstraints()" because "p" is null
  at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handlePolymorphic(BeanDeserializerBase.java:1749)
  at com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:541)
  at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1409)
  at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:352)
  at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:185)
  at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:323)
  at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4825)
  at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3772)
  at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3740)

Version information
Which Jackson version(s) was this for? 2.15.0

To Reproduce

Here's a minimal code to reproduce. Note the intentional mismatch between the supplied and expected field names (one and two).

public class Main {

  public static void main(String[] args) throws Exception {
    new ObjectMapper().readValue("{\"one\":1}", Parent.class);
  }

  public abstract static class Parent {
    @JsonCreator
    public static Parent create(@JsonProperty("two") String two) {
      return new Child();
    }
  }

  public static class Child extends Parent {}
}

Additional context

A more real-world example would be an AutoValue class. It would trigger the exception similarly to the example above.

The bug seems to have been introduced by #3691 in 2.15.0

[cowtowncoder]

I think this is the same as one transferred as #3913, closing as dup (even if earlier)