Make array __proto__ manipulations not disturb the species protector

src/isolate.cc

Index: src/isolate.cc
diff --git a/src/isolate.cc b/src/isolate.cc
index 56c3554cd886d0d42f7f29194335040a0fb2a609..926b9866d4e019afb8fad2dd811f876e20044449 100644
--- a/src/isolate.cc
+++ b/src/isolate.cc
@@ -2559,7 +2559,7 @@ bool Isolate::IsArraySpeciesLookupChainIntact() {
   // species protector is accurate, but this would be hard to do for most of
   // what the protector stands for:
   // - You'd need to traverse the heap to check that no Array instance has
-  //   a constructor property or a modified __proto__
+  //   a constructor property
   // - To check that Array[Symbol.species] == Array, JS code has to execute,
   //   but JS cannot be invoked in callstack overflow situations
   // All that could be checked reliably is that