Function xmlShellSave 

#[unsafe(no_mangle)]
pub unsafe extern "C" fn xmlShellSave(
    ctxt: *mut _xmlShellCtxt,
    filename: *mut c_char,
    _node: *mut _xmlNode,
    _node2: *mut _xmlNode,
) -> c_int

int xmlShellSave(xmlShellCtxtPtr ctxt, char *filename, xmlNodePtr node, xmlNodePtr node2) — the shell “save” command: write the current document to filename, or to its original name when no filename is given.

SAFETY

• ctxt, filename, _node, _node2 must be valid pointers (or NULL where the upstream C contract allows), obtained from the matching constructor/owner and not yet freed; the callee may take or keep ownership exactly as the C API specifies.

The caller must not race this call with concurrent mutation of the same objects from other threads (per-object state is not internally synchronized). Violating any of the above is undefined behavior.

Exercised by the C-API differential courts (courts/suites/data-abi/*-family-probe.c) and the CLI differential courts; those pass byte-for-byte against the upstream oracle.