> signal_thread_list_lock may be held in the timer thread during
> fork(),

I don't think it's possible.  see,

static void before_exec(void)
{
 (snip)
    if (!forked_child) {
        /*
         * On Mac OS X 10.5.x (Leopard) or earlier, exec() may return
ENOTSUPP
         * if the process have multiple threads. Therefore we have to
kill
         * internal threads temporary. [ruby-core: 10583]
         */
        rb_thread_stop_timer_thread(0);
    }
}

#define before_fork() before_exec()