Tag: Reporting Services

I recently experienced problems when trying to view a report for SQL Server Reporting Services with ReportViewer for MVC.

 

The report worked in some cases, but failed when certain parameters were set.

Exception and stack trace:

[ReportServerException: The report parameter 'DeviceTypes' is read-only and cannot be modified. (rsReadOnlyReportParameter)]
Microsoft.Reporting.WebForms.ServerReportSoapProxy.OnSoapException(SoapException e) +155
Microsoft.Reporting.WebForms.Internal.Soap.ReportingServices2005.Execution.ProxyMethodInvocation.Execute(RSExecutionConnection connection, ProxyMethod`1 initialMethod, ProxyMethod`1 retryMethod) +1256
Microsoft.Reporting.WebForms.Internal.Soap.ReportingServices2005.Execution.RSExecutionConnection.SetExecutionParameters(ParameterValue[] Parameters, String ParameterLanguage) +370
Microsoft.Reporting.WebForms.SoapReportExecutionService.SetExecutionParameters(IEnumerable`1 parameters, String parameterLanguage) +530
Microsoft.Reporting.WebForms.ServerReport.SetParameters(IEnumerable`1 parameters) +896
Microsoft.Reporting.WebForms.Report.SetParameters(ReportParameter parameter) +136
ReportViewerForMvc.ReportExtensions.SetParameters(Report report, ReportParameterInfoCollection collection) +114
ReportViewerForMvc.ReportViewerExtensions.SetProperties(ServerReport serverReport, ServerReport properties) +84
ReportViewerForMvc.ReportViewerExtensions.SetProperties(ReportViewer reportViewer, ReportViewer properties) +117
ReportViewerForMvc.ReportViewerWebForm.BuildReportViewer() +92
System.Web.UI.Control.OnLoad(EventArgs e) +109
System.Web.UI.Control.LoadRecursive() +68
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +4498

 

Checked the ReportServerService__*.log and ExecutionLog* database views, but they contained no additional clues about the error.

 

I attached WinDbg (x64) to the IIS worker process (w3wp.exe) and set a breakpoint with:

!bpmd   ReportViewerForMvc.dll   ReportViewerForMvc.ReportExtensions.SetParameters

Messages from WinDbg:

Found 2 methods in module 00007ff9bde79bb0...
MethodDesc = 00007ff9c00a30d0
MethodDesc = 00007ff9c00a30e0
Setting breakpoint: bp 00007FF9C0EE5590 [ReportViewerForMvc.ReportExtensions.SetParameters(Microsoft.Reporting.WebForms.Report, Microsoft.Reporting.WebForms.ReportParameterInfo)]
Setting breakpoint: bp 00007FF9C0EE53E4 [ReportViewerForMvc.ReportExtensions.SetParameters(Microsoft.Reporting.WebForms.Report, Microsoft.Reporting.WebForms.ReportParameterInfoCollection)]
Adding pending breakpoints...

 

Continued exection, reloaded the report and the breakpoint was hit.

Checked the .NET call stack with:

!clrstack -a

Part of the result:

OS Thread Id: 0x273c (45)
Child SP               IP Call Site
00000007dba9d030 00007ff9c0ee53e4 ReportViewerForMvc.ReportExtensions.SetParameters(Microsoft.Reporting.WebForms.Report, Microsoft.Reporting.WebForms.ReportParameterInfoCollection)
PARAMETERS:
report (<CLR reg>) = 0x0000000390e93650
collection (<CLR reg>) = 0x0000000490886678

 

Examined the collection object with:

!DumpObj /d 0000000490886678

Result:

Name:        Microsoft.Reporting.WebForms.ReportParameterInfoCollection
MethodTable: 00007ff9bff1cc98
EEClass:     00007ff9bff08d40
Size:        32(0x20) bytes
File:        C:\Windows\assembly\GAC_MSIL\Microsoft.ReportViewer.WebForms\11.0.0.0__89845dcd8080cc91\Microsoft.ReportViewer.WebForms.dll
Fields:
MT    Field   Offset                 Type VT     Attr            Value Name
00007ffa1b23d408  40017fa        8 ...Canon, mscorlib]]  0 instance 00000004908823f0 list
00007ffa1b8de068  40017fb       10        System.Object  0 instance 0000000000000000 _syncRoot

 

Examined the list array with:

!DumpArray /d 00000004908823f0

Result:

Name:        Microsoft.Reporting.WebForms.ReportParameterInfo[]
MethodTable: 00007ff9c0fd9e60
EEClass:     00007ffa1b2f0f10
Size:        120(0x78) bytes
Array:       Rank 1, Number of elements 12, Type CLASS
Element Methodtable: 00007ff9bff1cbc0
[0] 00000004908826c8
[1] 00000004908829d8
[2] 0000000490882ce8
[3] 00000004908832e0
[4] 0000000490884490
[5] 00000004908847a8
[6] 0000000490884ac0
[7] 0000000490884e38
[8] 00000004908853f8
[9] 0000000490885818
[10] 0000000490886250
[11] 00000004908865c8

 

Examined details for the list array with:

!DumpArray /d -details 00000004908823f0

Part of the result:

[11] 00000004908865c8
Name:        Microsoft.Reporting.WebForms.ReportParameterInfo
MethodTable: 00007ff9bff1cbc0
EEClass:     00007ff9bff08cc8
Size:        104(0x68) bytes
File:        C:\Windows\assembly\GAC_MSIL\Microsoft.ReportViewer.WebForms\11.0.0.0__89845dcd8080cc91\Microsoft.ReportViewer.WebForms.dll
Fields:
MT    Field   Offset                 Type VT     Attr            Value Name
00007ffa1b8dda88  4000120        8            System.String      0     instance     0000000490881950     m_name
00007ff9bff1c678  4000121       50             System.Int32      1     instance                    4     m_dataType
00007ffa1b8cd6f8  4000122       58           System.Boolean      1     instance                    0     m_isNullable
00007ffa1b8cd6f8  4000123       59           System.Boolean      1     instance                    1     m_allowBlank
00007ffa1b8cd6f8  4000124       5a           System.Boolean      1     instance                    1     m_isMultiValue
00007ffa1b8cd6f8  4000125       5b           System.Boolean      1     instance                    1     m_isQueryParameter
00007ffa1b8dda88  4000126       10            System.String      0     instance     000000038e411420     m_prompt
00007ffa1b8cd6f8  4000127       5c           System.Boolean      1     instance                    0     m_promptUser
00007ffa1b8cd6f8  4000128       5d           System.Boolean      1     instance                    1     m_areDefaultValuesQueryBased
00007ffa1b8cd6f8  4000129       5e           System.Boolean      1     instance                    1     m_areValidValuesQueryBased
00007ffa1b8dda88  400012a       18            System.String      0     instance     0000000000000000     m_errorMessage
00007ff9c0fda240  400012b       20     ...Viewer.WebForms]]      0     instance     0000000490886320     m_validValues
00007ffa1b23d128  400012c       28     ...tring, mscorlib]]      0     instance     0000000490886658     m_currentValues
00007ff9bff1c7c8  400012d       54             System.Int32      1     instance                    0     m_state
00007ff9bff1cc98  400012e       30     ...terInfoCollection      0     instance     0000000490886fb8     m_dependencyCollection
00007ff9bff1cc98  400012f       38     ...terInfoCollection      0     instance     0000000000000000     m_dependentsCollection
00007ffa1b8c1480  4000130       40          System.String[]      0     instance     0000000490881bb8     m_dependencies
00007ff9c0fda5d0  4000131       48     ...Viewer.WebForms]]      0     instance     0000000490886630     m_dependentsCollectionConstruction
00007ffa1b8cd6f8  4000132       5f           System.Boolean      1     instance                    1     m_visible

 

Examined the name of the last report parameter with:

!DumpObj /d 0000000490881950

Part of the result:

Name:        System.String
MethodTable: 00007ffa1b8dda88
EEClass:     00007ffa1b236a08
Size:        48(0x30) bytes
File:        C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
String:      DeviceTypes

So the last parameter was DeviceTypes, the one causing the problem.

 

Looked for a read-only property among the report parameters. Noticed that m_promptUser was 0 for the DeviceTypes parameter, while m_promptUser was 1 for all other parameters.

 

I decided to use procdump to log exception messages from the ReportingServicesService.exe process with:

procdump.exe -f "" -l -e 1 ReportingServicesService.exe

 

Reloaded the report to recreate the error.

Part of the result was:

[07:10:37] Exception: E0434F4D.Microsoft.ReportingServices.Diagnostics.Utilities.ReadOnlyReportParameterException ("The report parameter 'DeviceTypes' is read-only and cannot be modified.")
[07:10:37] Exception: E0434F4D.Microsoft.ReportingServices.Diagnostics.Utilities.RSException ("The report parameter 'DeviceTypes' is read-only and cannot be modified.")

 

Then loaded all DLL files from SSRS into ILSpy from:

C:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\ReportServer\bin

 

Searched for the ReadOnlyReportParameterException class in ILSpy.

Found it and noticed that it was apparently only used by:

Microsoft.ReportingServices.ReportProcessing.ParameterInfoCollection.Combine(...)

 

Read the decompiled code for the above method and noticed this part:

if (checkReadOnly && !parameterInfo.PromptUser)
{
  ParameterInfoCollection.ThrowReadOnlyParameterException(parameterInfo.Name, isSharedDataSetParameter);
}

Apparently the value of parameterInfo.PromptUser determined the read-only status.

 

I decided to examine the XML for the RDL report and noticed that the DeviceTypes report parameter did not have a Prompt section.

I added this:

<Prompt>DeviceTypes</Prompt>

Then uploaded the new version of the report (by overwriting).

However this did not seem to have any immediate effect, the error still occured…

 

I spent some time examining various other ideas and internals of SSRS.

 

Then I got an idea: I decided to delete the problematic report and then recreate the modified version with a Prompt section.

This fixed the problem! The report now worked in all cases, no matter which parameters were set.

This behavior was consistent across 2 SSRS instances.

Conclusion

It seems that read-only status for a report parameter is derived from the presence of a <Prompt>Description</Prompt> section.

However this status is not updated if the report is overwritten, it has to be deleted and then recreated…

 

Due to the way ReportViewerForMvc.dll is implemented all report parameters are copied from the initial instance to another instance of ReportViewer.

This means that report parameters can’t be read-only, so <Prompt>Description</Prompt> should always be specified for all report parameters, when using ReportViewer for MVC.

I was testing reports for SQL Server Reporting Services on a new computer, but the results were blank and no relevant error messages were logged by SSRS.

 

Investigated by using procdump to log exception messages from the IIS worker process with:

procdump.exe -f "" -l -e 1 ReportingServicesService.exe

Part of the result was:

[13:22:13] Exception: E0434F4D.System.Security.SecurityException ("Request for the permission of type 'System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.")
[13:22:13] Exception: E0434F4D.System.Security.SecurityException ("Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.")

 

I knew that the reports performed HTTP/web service calls from VB code, so I had to modify rssrvpolicy.config to allow this.

It can be done by:

1. Appending a named permission set with both execution and web permission like:

<PermissionSet class="NamedPermissionSet"
version="1"
Name="ExecutionAndWebPermission"
Description="A special permission set that grants execution and web permission for specific site(s).">
  <IPermission class="SecurityPermission" version="1" Flags="Execution" />
  <IPermission class="WebPermission" version="1">
    <ConnectAccess>
      <URI uri="http://localhost/Test/ReportingUtilityService.svc"/>
    </ConnectAccess>
  </IPermission>
</PermissionSet>

 

2. Modifying the CodeGroup with Name=”Report_Expressions_Default_Permissions”

From:

PermissionSetName="Execution"

To:

PermissionSetName="ExecutionAndWebPermission"

 

3. Restarting Reporting Services.

 

I decided to verify that this was the issue before performing the changes.

Therefore I attached WinDbg (x64) to ReportingServicesService.exe and configured event filters to break on CLR exceptions.

 

Refreshed the report again and the first exception was thrown.

Checked the exception with:

!PrintException

 

The result was a very detailed (and useful) message, that confirmed the suspected issue:

Exception object: 0000000460198410
Exception type: System.Security.SecurityException
Message: Request for the permission of type 'System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
InnerException: <none>
StackTrace (generated):
<none>
StackTraceString: <none>
HResult: 8013150a
SecurityException Message:
The action that failed was:
Demand
The type of the first permission that failed was:
System.Net.WebPermission
The first permission that failed was:
<IPermission class="System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1">
<ConnectAccess>
<URI uri="http://localhost/Test/ReportingUtilityService\.svc"/>
</ConnectAccess>
</IPermission>

The demand was for:
<IPermission class="System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1">
<ConnectAccess>
<URI uri="http://localhost/Test/ReportingUtilityService\.svc"/>
</ConnectAccess>
</IPermission>

The granted set of the failing assembly was:
<PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Flags="Execution"/>
<IPermission class="System.Security.Permissions.StrongNameIdentityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
PublicKeyBlob="..."
Name="expression_host_..."
AssemblyVersion="1.0.0.0"/>
<IPermission class="System.Security.Permissions.ZoneIdentityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Zone="MyComputer"/>
</PermissionSet>

The assembly or AppDomain that failed was:
expression_host_..., Version=12.2.6020.0, Culture=neutral, PublicKeyToken=null
The method that caused the failure was:
System.Object CallWebService(System.String, System.String)
The Zone of the assembly that failed was:
MyComputer

 

After modifying rssrvpolicy.config and restarting Reporting Services the issue was resolved.

While testing a modified SSRS report I noticed that certain values were not shown, only the message:

#Error

 

Neither the ReportServerService__*.log or ExecutionLog* database views contained any clues about the cause.

 

I used procdump to log exception messages from ReportingServicesService.exe with:

procdump.exe -f "" -l -e 1 ReportingServicesService.exe

Part of the result was:

[13:46:39] Exception: E0434F4D.System.InvalidOperationException ("Nullable object must have a value.")
[13:46:39] Exception: E0434F4D.System.FormatException ("Input string was not in a correct format.")
[13:46:39] Exception: E0434F4D.System.FormatException ("Input string was not in a correct format.")
[13:46:39] Exception: E0434F4D.System.InvalidCastException ("Conversion from string "Nullable object must have a valu" to type 'Decimal' is not valid.")

 

These exceptions were unexpected and puzzling. Additional examination was required.

 

I attached WinDbg (x64) to ReportingServicesService.exe and configured event filters to break on CLR exceptions.

 

Refreshed the report again and the first exception was thrown.

Verified the exception with:

!PrintException

The result was:

Exception object: 000000030d4c2f90
Exception type: System.InvalidOperationException
Message: Nullable object must have a value.
InnerException: <none>
StackTrace (generated):
<none>
StackTraceString: <none>
HResult: 80131509

 

Checked the .NET call stack with:

!clrstack

Part of the result was:

Child-SP         RetAddr          Call Site
0000000016d1b150 00007ff98347a650 System.ThrowHelper.ThrowInvalidOperationException(System.ExceptionResource)
0000000016d1b190 00007ff9271033ef System.Nullable`1[[System.Double, mscorlib]].op_Explicit(System.Nullable`1<Double>)
0000000016d1b1c0 00007ff927103310 ReportExprHostImpl+CustomCodeProxy.UnitConvertSlim(Double, System.String, System.String, System.String, System.Nullable`1<Double>, System.Nullable`1<Double>)
0000000016d1b290 00007ff92622c452 ReportExprHostImpl+Textbox9_TextBoxExprHost+Paragraph00_ParagraphExprHost+TextRun00_TextRunExprHost.get_ValueExpr()
0000000016d1b360 00007ff92622bedf Microsoft.ReportingServices.RdlExpressions.ReportRuntime.EvaluateTextRunValueExpression(Microsoft.ReportingServices.ReportIntermediateFormat.TextRun)

 

Also checked the .NET call stack including parameters and locals with:

!clrstack -a

However the majority of these were optimized away, only showing: <no data>

 

It’s relevant to mention that the report code in question contains multiple UnitConvert(…) functions with different parameter overloads.

 

At this point I made a mistake by reading UnitConvertSlim as UnitConvert. I mistakenly thought that the right UnitConvert(…) function was called.

 

I wanted to set a breakpoint to inspect the status before the exception occured, but this was complicated by the fact that ReportExprHostImpl+CustomCodeProxy is generated code.

(Managed to set breakpoints, but they were not hit, most likely because they were on previous versions of the generated code)

 

Being challenged by this, I decided to do something else.

I compared the old and new version of the report and realised that UnitConvertSlim(…) was another function than expected.

 

Therefore I decided to run the VB code in a simple, separate VB application, to enable normal debugging.

This required simulating certain SSRS classes and properties, in this case Report.Parameters(…).

 

By debugging the separate VB application I realized that the expected UnitConvert(…) function did not exist!

Instead another UnitConvert(…) function was found and called. Some parameters were converted to other types and this was the root cause of the problem…

 

I implemented the missing UnitConvert(…) function and this solved the problem, both in the separate VB application and in SSRS.

Conclusion

SSRS VB code may fail in unexpected ways, if a required function overload does not exist.

If debugging VB code in SSRS is problematic, try debugging it outside of SSRS in a separate program.

I was testing a modified report for SQL Server Reporting Services, but the results were blank and no relevant error messages were logged by SSRS.

Only messages like these that didn’t reveal the root cause:

ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerHttpRuntimeInternalException: RsWorkerRequest::FlushResponse., Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerHttpRuntimeInternalException: An internal or system error occurred in the HTTP Runtime object for application domain ReportServer_MSSQLSERVER_0-1-131184109058523378.  ---> System.Runtime.InteropServices.COMException (0x800703E3): The I/O operation has been aborted because of either a thread exit or an application request. (Exception from HRESULT: 0x800703E3)

 

Started troubleshooting by comparing the modified report with the original version, but I could see no obvious problems in either version.

 

When testing the report through the Report Viewer component resulted in this exception:

[XmlException: '♫', hexadecimal value 0x0E, is an invalid character. Line 1, position 6512.]
   System.Xml.XmlTextReaderImpl.Throw(Exception e) +88
   System.Xml.XmlTextReaderImpl.ParseNumericCharRefInline(Int32 startPos, Boolean expand, StringBuilder internalSubsetBuilder, Int32& charCount, EntityType& entityType) +817
   System.Xml.XmlTextReaderImpl.ParseCharRefInline(Int32 startPos, Int32& charCount, EntityType& entityType) +98
   System.Xml.XmlTextReaderImpl.ParseText(Int32& startPos, Int32& endPos, Int32& outOrChars) +816
   System.Xml.XmlTextReaderImpl.ParseText() +126
   System.Xml.XmlTextReaderImpl.ParseElementContent() +438
   System.Xml.XmlReader.ReadElementString() +84
   Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderServerReportSoapProxy.Read5_ValidValue(Boolean isNullable, Boolean checkType) +489

 

I wanted to verify that it was the same problem in pure SSRS, so I used ProcDump to log exception messages with:

procdump.exe -f "" -l -e 1 ReportingServicesService.exe

 

The result was:

[17:47:58] Exception: E0434F4D.System.Xml.XmlException ("'♫', hexadecimal value 0x0E, is an invalid character. Line 1, position 6508.")
[17:47:58] Exception: E0434F4D.System.InvalidOperationException ("There is an error in XML document (1, 6508).")
[17:47:58] Exception: E0434F4D.MissingEndpointException ("The attempt to connect to the report server failed. Check your connection information and that the report server is a compatible version.")
[17:47:58] Exception: E0434F4D.System.Runtime.InteropServices.COMException ("The I/O operation has been aborted because of either a thread exit or an application request. (Exception from HRESULT: 0x800703E3)")
[17:47:58] Exception: E0434F4D.System.Runtime.InteropServices.COMException ("The I/O operation has been aborted because of either a thread exit or an application request. (Exception from HRESULT: 0x800703E3)")
[17:47:58] Exception: E0434F4D.Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerHttpRuntimeInternalException ("An internal or system error occurred in the HTTP Runtime object for application domain ReportServer_MSSQLSERVER_0-1-131184109058523378. ")

 

That confirmed that the problem was caused by invalid XML characters somewhere.

 

I wanted to see the XML that contained the invalid characters, so I attached WinDbg to ReportingServicesService.exe and enabled the CLR Exception event filter.

 

Refreshed the report to reproduce the problem.

Tried looking at the .NET call stack including parameters and locals with:

!clrstack -a

First part of the stack was:

OS Thread Id: 0x1d84 (26)
        Child SP               IP Call Site
00000011d267d1d8 00007ffef2638a5c [HelperMethodFrame: 00000011d267d1d8] 
00000011d267d2c0 00007ffedc73e488 System.Xml.XmlTextReaderImpl.Throw(System.Exception)
    PARAMETERS:
        this = <no data>
        e = <no data>
    LOCALS:
        <no data>

00000011d267d300 00007ffedc3cfd11 System.Xml.XmlTextReaderImpl.ParseNumericCharRefInline(Int32, Boolean, System.Text.StringBuilder, Int32 ByRef, EntityType ByRef)
    PARAMETERS:
        this (0x00000011d267d380) = 0x0000000fae5d0c00
        startPos = <no data>
        expand (0x00000011d267d390) = 0x0000000000000001
        internalSubsetBuilder (0x00000011d267d398) = 0x0000000000000000
        charCount (0x00000011d267d3a0) = 0x00000011d267d3f0
        entityType = <no data>
    LOCALS:
        <no data>
        0x00000011d267d340 = 0x0000000000000a6b
        0x00000011d267d330 = 0x0000000fae5d1328
        <no data>
        <no data>
        <no data>
        <no data>
        <no data>
        <CLR reg> = 0x000000000000000e
        <no data>
        <no data>

 

I examined the local object 0x0000000fae5d1328 with:

!DumpObj /d 0000000fae5d1328

Which seemed to be used as a buffer for XML data:

Name:        System.Char[]
MethodTable: 00007ffee08debd0
EEClass:     00007ffee02f10d0
Size:        8218(0x201a) bytes
Array:       Rank 1, Number of elements 4097, Type Char (Print Array)
Content:     MultiValue>true</MultiValue><QueryParameter>true</QueryParameter><Prompt>Device Type</Prompt><PromptUser>true</PromptUser><Depen
Fields:
None

 

I decided to find the adresses involved by dumping the array with:

!DumpArray /d 0000000fae5d1328

Part of the result was:

Name:        System.Char[]
MethodTable: 00007ffee08debd0
EEClass:     00007ffee02f10d0
Size:        8218(0x201a) bytes
Array:       Rank 1, Number of elements 4097, Type Char
Element Methodtable: 00007ffee08dec38
[0] 0000000fae5d1338
[1] 0000000fae5d133a
...
...
[4095] 0000000fae5d3336
[4096] 0000000fae5d3338

 

Now knowing the address range the unicode characters in the buffer could be read with:

du 0000000fae5d1338 0000000fae5d3338

Part of the result was:

0000000f`ae5d1338  "MultiValue>true</MultiValue><Que"
0000000f`ae5d1378  "ryParameter>true</QueryParameter"
...
...
0000000f`ae5d27b8  "/Value></ValidValue><ValidValue>"
0000000f`ae5d27f8  "<Label>♫♫113897</Label><"
0000000f`ae5d2838  "Value>52b3bc3a-32a8-49fc-a658-66"
0000000f`ae5d2878  "c67d3b29f6</Value></ValidValue><"
...
...

 

Checked the XML for invalid characters and eventually found some.

In a more readable form:

<ValidValue>
  <Label>♫♫113897</Label>
  <Value>52b3bc3a-32a8-49fc-a658-66c67d3b29f6</Value>
</ValidValue>

 

I thought it would be interesting to see the last query before the exception occured, so I started a trace with SQL Server Profiler and found:

SELECT cast(cast(0 as binary) as uniqueidentifier) AS Id, 'UNKNOWN' AS Username
UNION
SELECT Id, Username FROM Users order by 2

 

Tried running the query in SQL Server Management Studio and part of the result was:

 

Certain usernames actually contained characters that are invalid in XML.

This was the underlying cause behind the problem.

Conclusion

When SSRS reports fail without a clear indication of the cause, I recommend using a variety of tools and techniques to debug the problem similar to the described approach.