Version 5.1.281.35 (cherry-pick)

src/isolate.cc

Index: src/isolate.cc
diff --git a/src/isolate.cc b/src/isolate.cc
index 34bb33b03d1b2fd617e4d38e0ada0a71237ea21b..fdf89e7569d81855cf570aa1134eea46cfba0ae3 100644
--- a/src/isolate.cc
+++ b/src/isolate.cc
@@ -2553,7 +2553,7 @@ bool Isolate::IsArraySpeciesLookupChainIntact() {
   // species protector is accurate, but this would be hard to do for most of
   // what the protector stands for:
   // - You'd need to traverse the heap to check that no Array instance has
-  //   a constructor property or a modified __proto__
+  //   a constructor property
   // - To check that Array[Symbol.species] == Array, JS code has to execute,
   //   but JS cannot be invoked in callstack overflow situations
   // All that could be checked reliably is that