What happened?

If you turn on the "Month" filter for article listings (Content → Options → List Layouts → Filter Field = "Month"), every category page on the site breaks with a fatal error instead of showing the article list. The month-filter dropdown is built by copying a whole batch of settings from one internal object to another using a simple loop, and that loop accidentally unpacks the site's display settings into a plain array instead of keeping them as the object type the rest of the code expects. A few lines down, the code tries to call a method on that object and gets a plain array instead, so it crashes.

Steps to reproduce:

1. Go to Content → Options (com_content component options).
2. On the List Layouts tab, set Filter Field to "Month" (filter_field = month).
3. Save & Close.
4. Visit the front-end page of any category that uses a listing layout showing the article list with the month-filter control — e.g. a menu item of type "Category Blog" or "List Layouts" pointing to any published category, or the category's own category_layout inheriting the global default.

No other special configuration is needed — this is the site-wide com_content component default, so it affects every category using the default list/blog layout, not just one.

Version

6.1

Expected result

The category page renders normally, with the month-filter dropdown listing available months.

Actual result

A fatal error is thrown:

0
Call to a member function get() on array

Stack trace bottoms out at:

components/com_content/src/Model/ArticlesModel.php:276
$orderby_sec = $params->get('orderby_sec');

where $params = $this->getState('params'); is a plain PHP array instead of the expected Joomla\Registry\Registry instance.

System Information

• Joomla! 6.1.3 Stable [ Nyota ]
• PHP 8.4
• MySQL 8.x (issue reproduced against both MySQL 8 and MariaDB 10.6 backends — not DB-engine specific)
• Confirmed still present, unpatched, on the 6.2-dev branch (same code in libraries/src/HTML/Helpers/Content.php)

Additional Comments

Root cause is in libraries/src/HTML/Helpers/Content.php, static method Content::months():

public static function months($state)
{
    ...
    $model = $contentComponent->getMVCFactory()
        ->createModel('Articles', 'Site', ['ignore_request' => true]);

    foreach ($state as $key => $value) {
        $model->setState($key, $value);
    }
    ...
}

$state here is the calling model's full state object (a Registry, obtained via $this->getState() with no argument). The foreach relies on Registry::getIterator():

// libraries/vendor/joomla/registry/src/Registry.php
public function getIterator()
{
    return new \ArrayIterator($this->toArray());
}

public function toArray()
{
    return $this->asArray($this->data);
}

protected function asArray($data)
{
    $array = [];
    if (\is_object($data)) {
        $data = \get_object_vars($data);
    }
    foreach ($data as $k => $v) {
        if (\is_object($v) || \is_array($v)) {
            $array[$k] = $this->asArray($v);   // <-- recurses into ANY nested object
            continue;
        }
        $array[$k] = $v;
    }
    return $array;
}

asArray() recurses into every nested object, with no exception for another Registry instance. Since the original model's state stores its own 'params' entry as a Registry object (set in CategoryModel/ArticlesModel::populateState() via $this->setState('params', Factory::getApplication()->getParams())), iterating the outer state via foreach runs it through toArray() → asArray(), which recurses into that nested Registry and calls get_object_vars() on it too — returning the Registry's own internal properties (data, initialized, separator) as a plain array, instead of the actual parameter key/value pairs.

That flattened array is then passed straight into $model->setState('params', $value) inside the foreach loop, so the new ArticlesModel instance's 'params' state ends up being:

[
    'data' => [ /* the real params, one level too deep */ ],
    'initialized' => true,
    'separator' => '.',
]

instead of a Registry object. Any later code expecting getState('params') to be a Registry (e.g. ArticlesModel::getListQuery() line 276, $params->get('orderby_sec')) then fails with Call to a member function get() on array.

Suggested fix: in Content::months(), either skip re-iterating/copying the 'params' key generically and set it explicitly (mirroring how CategoryModel::getItems() already does it, e.g. $model->setState('params', Factory::getApplication()->getParams())), or have Registry::asArray() stop recursing into instances of Registry itself (treat a nested Registry as an opaque value, not something to flatten further).

Reported by Gabriel de Freitas Camacho, developer at CBMSC (Corpo de Bombeiros Militar de Santa Catarina). Bug found with the assistance of Claude IA.
Official site: "(https://portal.cbm.sc.gov.br)"