Nothing automatically occurs when the user closes a browser window or navigates to another page, if the request is still processing. This is why the HttpResponse.IsClientConnected
property exists - so your code can perform appropriate checks as and when you can do something useful.
If a timeout occurs on the server side, then the finally
block should operate at around that time and the lock will be released. Whether it is safe for the lock to be released at this time is something only you can determine - the lock must have been put there for a reason, and if a timeout occurs, that may mean that the (shared, lock requiring state) isn't stable for whoever next acquires the lock.
But these are two very different sets of issues.