fix: prevent hang in TaskQueue.Dispose when closing connections with pending messages

The tab target model (upstream #14821) causes Chrome to emit many
Target.attachedToTarget events; each is processed via an async void
Transport_MessageReceived that calls _callbackQueue.Enqueue, queueing
many SemaphoreSlim.WaitAsync callers.

The old TaskQueue.Dispose called _semaphore.Wait() synchronously,
blocking until every pending waiter drained — which never happened
while the Connection was still receiving events, causing a 40+ second
hang in ShouldWorkAcrossSessions.

Fix by adding a CancellationTokenSource to TaskQueue: Dispose() cancels
it, causing all pending WaitAsync(_disposeCts.Token) callers to receive
OperationCanceledException and exit immediately, so Dispose returns
without blocking.

Also included:
- Idempotent Connection.Dispose() guard to prevent double-dispose
- Session/callback cleanup moved before Disconnected fires to avoid
  a deadlock where the Disconnected handler awaits a session response
  that will never arrive
- CdpCDPSession re-checks Detached after inserting into _callbacks
  to close a race window where Close() could miss the new entry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kblok

lib/PuppeteerSharp/Cdp/CdpCDPSession.cs

@@ -103,6 +103,19 @@ public override async Task DetachAsync()
                 Message = message,
             };
             _callbacks[id] = callback;
+
+            // Re-check Detached after adding to _callbacks. This closes the race where
+            // Close() runs between our initial Detached check and the dictionary insertion,
+            // leaving our callback uncancelled so the response wait never resolves.
+            if (Detached)
+            {
+                _callbacks.TryRemove(id, out _);
+                throw new TargetClosedException(
+                    $"Protocol error ({method}): Session closed. " +
+                    $"Most likely the {_targetType} has been closed." +
+                    $"Close reason: {CloseReason ?? Connection.CloseReason}",
+                    CloseReason ?? Connection.CloseReason);
+            }
         }
 
         try

lib/PuppeteerSharp/Cdp/Connection.cs

@@ -28,6 +28,7 @@ public sealed class Connection : IDisposable, ICDPConnection
         private readonly AsyncDictionaryHelper<string, CdpCDPSession> _sessions = new("Session {0} not found");
         private readonly List<string> _manuallyAttached = [];
         private int _lastId;
+        private int _disposed;
 
         private Connection(string url, int delay, bool enqueueAsyncMessages, IConnectionTransport transport, ILoggerFactory loggerFactory = null, int protocolTimeout = DefaultCommandTimeout)
         {
@@ -102,6 +103,11 @@ private Connection(string url, int delay, bool enqueueAsyncMessages, IConnection
         /// <inheritdoc />
         public void Dispose()
         {
+            if (Interlocked.Exchange(ref _disposed, 1) != 0)
+            {
+                return;
+            }
+
             Dispose(true);
             GC.SuppressFinalize(this);
         }
@@ -223,8 +229,11 @@ internal void Close(string closeReason)
             CloseReason = closeReason;
 
             Transport.StopReading();
-            Disconnected?.Invoke(this, EventArgs.Empty);
 
+            // Cancel all pending session commands and callbacks before firing Disconnected.
+            // This prevents a deadlock where the Disconnected handler (via CloseCoreAsync)
+            // tries to dispose the callback queue while a queued message is awaiting a
+            // session response that will never arrive (because session cleanup hasn't run yet).
             foreach (var session in _sessions.Values)
             {
                 session.Close(closeReason);
@@ -241,6 +250,8 @@ internal void Close(string closeReason)
 
             _callbacks.Clear();
             MessageQueue.Dispose();
+
+            Disconnected?.Invoke(this, EventArgs.Empty);
         }
 
         internal CdpCDPSession GetSession(string sessionId) => _sessions.GetValueOrDefault(sessionId);

lib/PuppeteerSharp/Helpers/TaskQueue.cs

@@ -8,6 +8,7 @@ internal sealed class TaskQueue : IDisposable, IAsyncDisposable
     {
         private readonly SemaphoreSlim _semaphore;
         private readonly AsyncLocal<bool> _held = new();
+        private readonly CancellationTokenSource _disposeCts = new();
         private int _disposed;
 
         internal TaskQueue() => _semaphore = new SemaphoreSlim(1);
@@ -19,11 +20,8 @@ public void Dispose()
                 return;
             }
 
-            if (!_held.Value)
-            {
-                _semaphore.Wait();
-            }
-
+            _disposeCts.Cancel();
+            _disposeCts.Dispose();
             _semaphore.Dispose();
         }
 
@@ -44,7 +42,15 @@ public async ValueTask DisposeAsync()
 
         internal async Task<T> Enqueue<T>(Func<Task<T>> taskGenerator)
         {
-            await _semaphore.WaitAsync().ConfigureAwait(false);
+            try
+            {
+                await _semaphore.WaitAsync(_disposeCts.Token).ConfigureAwait(false);
+            }
+            catch (OperationCanceledException)
+            {
+                return default;
+            }
+
             try
             {
                 _held.Value = true;
@@ -59,7 +65,15 @@ internal async Task<T> Enqueue<T>(Func<Task<T>> taskGenerator)
 
         internal async Task Enqueue(Func<Task> taskGenerator)
         {
-            await _semaphore.WaitAsync().ConfigureAwait(false);
+            try
+            {
+                await _semaphore.WaitAsync(_disposeCts.Token).ConfigureAwait(false);
+            }
+            catch (OperationCanceledException)
+            {
+                return;
+            }
+
             try
             {
                 _held.Value = true;