MacOS – How to find out which application(s) created core dumps

Yes. You have enabled auditing somewhere along the line, being a wise person, but you have not trimmed the file, being a human, like I. Note the instant edit ;)

man -k audit

if you can get a shell will show you where you need to go

( look at them on the apple dev site )

i think here you want

audit -e 

to get rid of your old audit files.

From the man page:

The audit utility controls the state of the audit system. One of the following flags is required as an argument to audit:

 -e      Forces the audit system to immediately remove audit log files
         that meet the expiration criteria specified in the audit control
         file without doing a log rotation.

 -i      Initializes and starts auditing.  This option is currently for
         Mac OS X only and requires auditd(8) to be configured to run
         under launchd(8).

 -n      Forces the audit system to close the existing audit log file and
         rotate to a new log file in a location specified in the audit
         control file.  Also, audit log files that meet the expiration
         criteria specified in the audit control file will be removed.

 -s      Specifies that the audit system should [re]synchronize its con-
         figuration from the audit control file.  A new log file will be
         created.

 -t      Specifies that the audit system should terminate.  Log files are
         closed and renamed to indicate the time of the shutdown.

On my system:

ls /var/audit
20110414160828.20110415024057 20110420155533.20110421134946
20110415024148.20110416200834 20110421140348.20110421151928
20110416200951.20110417013744 20110421152018.20110422125418
20110417014358.crash_recovery 20110422125606.20110422205003
20110417024720.20110417120347 20110422205003.20110423102007
20110417135346.20110419142539 20110423102114.20110423204207
20110419144659.20110419150605 20110423204320.20110424094847
20110419150626.20110419201121 20110424094940.not_terminated
20110419201223.20110419225009 build
20110419225100.20110420153215 current
[root:8va:0:~ ]# du -h /var/audit
4.0K    /var/audit/build
6.0M    /var/audit

Yes. It's audit -e

[root:8va:0:~ ]# audit -e
Trigger sent.
[root:8va:0:~ ]# du -h /var/audit
4.0K    /var/audit/build
6.0M    /var/audit

The code crashed in a drawing routine. I edited the post to show you the relevant thread 0 that was responsible for the crash (if you trust the logs and in this case, everything seems normal and this is a user program crash, so it's generally more reliable than a kernel log).

Three things can be done to reduce or eliminate the crash:

1. Figure out what part of the drawing code is responsible for the crash over time and reduce / eliminate that part of the program by not using it.
2. Get the source code and fix it (it could also be an Apple Bug where you need to update the OS or even upgrade to really fix the issue.) Only someone with access to the source code generally can make that call.
3. Change the data the program uses (remove some settings, features, etc) and hope that it reduces the chance the program has to draw the same data in the crashing routine.

Also, there is a 4th item - it could be a somewhat random occurrence. Unless you can discover how to make things crash each and every time, it's best to keep a paper (or other) log of when it crashes and save the logs. After about 10 times patterns usually start to form that help you know what is causing a crash.